Encryption method and apparatus

ABSTRACT

Arbitrary quantum information is input. The information of a quantum two-state system is acquired as a qubit by performing a computation in consideration of a physical system. The acquired qubit is encrypted. A quantum system having signature information for guaranteeing that the qubit is really transferred from a sender to a recipient is added to the encrypted qubit. The qubit to which the quantum system having the signature information is added is further encrypted. In this manner, an arbitrary quantum state can be encrypted and transmitted without letting the sender and recipient share an entangled pair of qubits in advance.

FIELD OF THE INVENTION

[0001] The present invention relates to an encryption method andapparatus for an arbitrary quantum state.

BACKGROUND OF THE INVENTION

[0002] Recent years have seen rapid advances in quantum informationtheory and quantum computation theory which perform unconventionalinformation processing by effectively using the principles of quantummechanics (P. W. Shor, “Algorithms for quantum computation: Discretelogarithms and factoring” in Proceedings of the 35th Annual Symposium onFoundations of Computer Science (ed. S. Goldwasser) 124-134 (IEEEComputer Society, Los Alamitos, Calif., 1994), P. W. Shor,“Polynomial-Time Algorithms for Prime Factorization and DiscreteLogarithms on a Quantum Computer”, SIAM J. Computing 26, 1483 (1997),and D. Deutsch and R. Jozsa, “Rapid solution of problems by quantumcomputation”, Proc. R. Soc. Lond. A 349, 553 (1992)). Concurrently withthese theories, studies have also been made to apply uncertainty ofquantum theory, the quantum no-cloning theorem for pure quantum states,and entanglement between quantum systems to encryption. Of the methodsstudied, BB84 is considered as an effective key distribution method,which can implement highly safe encryption in combination with theone-time pad method (C. H. Bennett and G. Brassard, “Quantumcryptography: Public key distribution and coin tossing”, Proceedings ofIEEE International Conference on Computers, Systems, and SignalProcessing, Bangalore, India, pp. 175-179, December 1984, C. H. Bennett,F. B. Bessette, G. Brassard, L. Salvail and J. Smolin, “ExperimentalQuantum Cryptography”, J. Cryptography, 5: 3-28 (1992), and C. H.Bennett, G. Brassard, and A. K. Ekert, “Quantum Cryptography”,Scientific American, 267, No. 4, 50-57, October 1992). Quantumteleportation is considered as a method of effectively transmitting anarbitrary quantum state (C. H. Bennett, G. Brassard, C. Cepeau, R.Jozsa, A. Peres and W. K. Wootters, “Teleporting an unknown quantumstate via dual classic and Einstein-Podolsky-Rosen channels”, Phys. Rev.Lett. 70, 1895 (1993), D. Bouwmeester, J-W. Pan, K. Mattle, M. Eibl, H.Weinfurter and A. Zeilinger, “Experimental quantum teleportation”,Nature 390, 575-579 (1997), and A. Furusawa, J. L. Sorensen, S. L.Braunstein, C. A. Fuchs, H. J. Kimble and E. S. Polzik, “UnconditionalQuantum Teleportation”, Science 282, 706-709 (1998)).

[0003] A sender of information, recipient, and eavesdropper will bereferred to as Alice, Bob, and Eve, respectively, in accordance with thepractices in the field of encryption.

[0004] BB84 is used to share a classical random string without makingthe third party know it. The sender Alice randomly selects one of fourtypes of states, i.e., {|0>,|1>} of a rectilinear basis and {(1/{squareroot}{square root over (2)})(|0>±|1>)} of a circular basis as one photon(two-state system or qubit) state, and sends it to the recipient Bob.Bob randomly selects one of two types of bases independently of Alice,and observes the sent photon with the selected basis. This process isrepeated, and data is adopted only when the bases selected by Alice andBob match. In this case, |0>,(1/{square root}{square root over(2)})(|0>+|1>) is made to correspond to the bit value “0”, and|1>,(1/{square root}{square root over (2)})(|0>−1>) is made tocorrespond to “1”.

[0005] The rectilinear basis and the circular basis are inconsistentwith each other. The data obtained by observation with wrong basesbecome random probabilistically. Assume that the eavesdropper Eveextracts a photon on the way, observes it with some basis, and sendssubstitute photon. In this case, a contradiction arises with aprobability of ¼ or more per photon. As a consequence, Alice and Bobnotice eavesdropping. As described above, BB84 effectively uses theuncertainty principle of quantum mechanics to detect the presence of aneavesdropper.

[0006] A. K. Ekert has proposed a protocol for performing classicalrandom key distribution by distributing two qubits of EPR-state|ψ^(˜)>=(1/{square root}{square root over (2)})(|01>−|10>) to Alice andBob (A. K. Ekert, “Quantum Cryptography Based on Bell's Theorem”, Phys.Rev. Lett. 67, 661 (1991)). The intervention of Eve is detected by theBell's theorem. Each of Alice and Bob randomly selects one of threetypes of predetermined bases, and observes the EPR-state qubit on hand.This process is repeated, and the result obtained when bases match isadopted as data for a key. If observation is made with different bases,the result is disclosed through a public channel, and a correlationfunction S is calculated. Eavesdropping is detected on the basis of thedifference between the correlation functions S with and without theintervention of Eve.

[0007] C. H. Bennett et al. have studied the protocol obtained bysimplifying the protocol by A. K. Ekert, and showed that the protocolwas equivalent to BB84 (C. H. Bennett, G. Brassard, and N. D. Mermin,“Quantum Cryptography without Bell's Theorem”, Phys. Rev. Lett. 68, 557(1992)). According to C. H. Bennett et al., each of Alice and Bob ismade to select two types of observation bases, and Alice is made to havean EPR-state source. Alice leaves one of a pair of qubits generated bythe EPR-state source on her side, makes observation with a basisrandomly selected from the rectilinear basis and the circular basis, andsends the remaining qubit to Bob. The results obtained when theobservation bases on the Alice and Bob sides match are adopted as data,and some of the data are used for detection of Eve. It is impossible todiscern whether the randomness of signals transmitted from Alice to Bobis based on observation of EPR-state or a classical random number. Thatis, this technique is equivalent to BB84. Owing to these studies, it hasbeen recognized that classical key distribution based on quantummechanics can be satisfactorily performed by utilizing only uncertainty,and entanglement is not necessarily required. (It is, however, knownthat a combination of the technique called entanglement purificationprotocol and the protocol by Ekert makes it possible to execute highlysafe classical key distribution (C. H. Bennett, G. Brassard, S. Popescu,B. Schumacher, J. A. Smolin, and W. K. Wootters, “Purification of NoisyEntanglement and Faithful Teleportation via Noisy Channels”, Phys. Rev.Lett. 76, 722 (1996), D. Deutsch, A. Ekert, R. Jozsa, C. Macchiavello,S. Popescu and A. Sanpera, “Quantum Privacy Amplification and theSecurity of Quantum Cryptography over Noisy Channels”, Phys. Rev. Lett.77, 2818 (1996), C. H. Bennett, D. P. DiVincenzo, J. A. Smolin, and W.K. Wootters, “Mixed-state entanglement and quantum error correction”,Phys. Rev. A54, 3824 (1996)).

[0008] Quantum teleportation is used to transmit an arbitrary quantumstate. Assume that Alice and Bob share a pair of qubits in the EPR-statein advance. Alice observe a qubit in a state |Ψ> to be transmitted and aqubit in the EPR-state on hand with four Bell states as a base. Alicenotifies Bob of the observation result as 2-bit classical informationthrough a public channel. Bob performs unitary transformation of thequbit in the EPR-state in accordance with this notification from Alice.As a result, the qubit held by Bob is set in the state |Ψ> which Alicewanted to transmit. This method is characterized in that the classicalinformation of |Ψ> is completely separated from non-classicalinformation, and only the classical information is sent through thepublic channel. From this reason, Alice need not know the accurateposition of Bob. In addition, eavesdropping is theoretically impossibleas long as the EPR-state is properly shared. Eve cannot even destroy thequantum information |Ψ>.

[0009] There is an intimate connection between these methods and theno-cloning theorem. This theorem states that there is no unitarytransformation that clones an arbitrary quantum state (W. K. Woottersand W. H. Zurek, “A single quantum cannot be cloned”, Nature 299,802-803 (1982)). In BB84, this theorem is effective in the followingpoint. Even if Eve intercepts a qubit (photon) midway along a quantumchannel, she cannot discern which one of two types of bases is selected.Eve cannot therefore clone the qubit and leave the clone on hand. As aconsequence, Eve must observe the qubit with some basis and sendsubstitute qubit in accordance with the observation result. In thissense, the “no cloning theorem” may be considered as another expressionof uncertainty. According to quantum teleportation, Alice cannot clonethe state |Ψ> which she wants to transmit, and hence cannot observe |Ψ>). This is because, observation may disturb the original quantuminformation. In quantum teleportation, both Alice and Bob have noknowledge about the quantum state |Ψ> that is being transmittedthroughout the process.

[0010] Recently, a method of safely transmitting classical binary data(not classical random string) by using two photons in the Bell state hasbeen proposed (K. Shimizu and N. Imoto, “Communication channels securedfrom eavesdropping via transmission of photonic Bell states”, Phys. Rev.A 60, 157 (1999)). According to the characteristic features of thismethod, each of Alice and Bob prepares two types of bases on H₂ ² andperforms encoding and observation. In addition, encoding is performed byusing only the degree of freedom corresponding to two dimensions out offour dimensions of the Hilbert space.

[0011] Quantum teleportation has excellent properties when it is used asa method of transmitting an arbitrary quantum state. However, a sender(Alice) and recipient (Bob) must share a pair of entangled qubits priorto operation for transmission. This pair of qubits are generated by agiven source first, and then must be distributed to the sender (Alice)and recipient (Bob) via a quantum channel. If, therefore, aneavesdropper (Eve) intercepts the qubit to be held by the recipient(Bob) midway along a quantum channel, eavesdropping will becomesuccessful. To avoid such a danger, the sender (Alice) and recipient(Bob) distribute many pairs of entangled qubits to each other first, andthen purify them by a technique called entanglement purificationprotocol (C. H. Bennett, G. Brassard, S. Popescu, B. Schumacher, J. A.Smolin, and W. K. Wootters, “Purification of Noisy Entanglement andFaithful Teleportation via Noisy Channels”, Phys. Rev. Lett. 76, 722(1996), D. Deutsch, A. Ekert, R. Jozsa, C. Macchiavello, S. Popescu andA. Sanpera, “Quantum Privacy Amplification and the Security of QuantumCryptography over Noisy Channels”, Phys. Rev. Lett. 77, 2818 (1996), andC. H. Bennett, D. P. DiVincenzo, J. A. Smolin, and W. K. Wootters,“Mixed-state entanglement and quantum error correction”, Phys. Rev. A54,3824 (1996)).

SUMMARY OF THE INVENTION

[0012] It is an object of the present invention to provide a method andapparatus for encrypting and transmitting an arbitrary quantum statewithout letting a sender and recipient share an entangled pair of qubitsin advance.

[0013] According to one aspect of the present invention, there isprovided an encryption method comprising:

[0014] the acquisition step of inputting arbitrary quantum informationand acquiring information of a quantum two-state system as a qubit byperforming a computation in consideration of a physical system;

[0015] the first encryption step of encrypting the qubit acquired in theacquisition step;

[0016] the adding step of adding to the encrypted qubit a quantum systemhaving signature information for guaranteeing that the qubit is reallytransferred from a sender to a recipient; and

[0017] the second encryption step of encrypting the quantum to which thequantum system having the signature information is added.

[0018] According to another aspect of the present invention, there isprovided an encryption apparatus comprising: acquisition means forinputting arbitrary quantum information and acquiring information of aquantum two-state system as a qubit by performing a computation inconsideration of a physical system;

[0019] first encryption means for encrypting the qubit acquired by saidacquisition means;

[0020] adding means for adding to the qubit a quantum system havingsignature information for guaranteeing that the qubit is reallytransferred from a sender to a recipient; and

[0021] second encryption means for encrypting the quantum to which thequantum system having the signature information is added.

[0022] Other features and advantages of the present invention will beapparent from the following description taken in conjunction with theaccompanying drawings, in which like reference characters designate thesame or similar parts throughout the figures thereof.

BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The accompanying drawings, which are incorporated in andconstitute a part of the specification, illustrate embodiments of theinvention and, together with the description, serve to explain theprinciples of the invention.

[0024]FIG. 1 is a view showing quantum cryptographic communicationbetween Alice and Bob, which is used in the first embodiment;

[0025]FIG. 2 is a view showing the second encryption performed by Alice,which is used in the first embodiment;

[0026]FIGS. 3A and 3B are views showing typical quantum gates used inthe first embodiment;

[0027]FIG. 4 is a view showing an eavesdropping strategy taken by Eve,which is used in the first embodiment;

[0028]FIG. 5 is a view showing a quantum gate network for counting thenumber of qubits, which is used in the first embodiment;

[0029]FIG. 6 is a view showing Intercept/Resend attack made by Eveagainst a system S, which is used in the first embodiment;

[0030]FIG. 7 is a view showing Intercept/Resend attack made by Eveagainst one qubit, which is used in the first embodiment;

[0031]FIG. 8 is a view showing Intercept/Resend attack made by Eveagainst systems S and Q, which is used in the first embodiment;

[0032]FIGS. 9A and 9B are views showing Intercept/Resend attack made byEve against the systems Q and S by using entanglement, which are used inthe first embodiment;

[0033]FIG. 10 is a view showing a quantum gate network for 2-qubitpermutation, which is used in the second embodiment;

[0034]FIG. 11 is a view showing a network that makes a quantuminformation qubit have parity, which is used in the second embodiment;

[0035]FIGS. 12A to 12C are views showing photon-counting measurementusing a nonlinear device, which are used in the third embodiment;

[0036]FIG. 13 is a view showing energy shifts due to Zeeman term andscalar coupling term in two nuclear spin systems, which is used in thefourth embodiment;

[0037]FIG. 14 is a view for explaining the arrangement of an encryptionapparatus according to the first and second embodiments;

[0038]FIG. 15 is a view showing procedures in a quantum state encryptionmethod according to the first embodiment; and

[0039]FIG. 16 is a view showing procedures in a quantum state encryptionmethod according to the second embodiment.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0040] Preferred embodiments of the present invention will now bedescribed in detail in accordance with the accompanying drawings.

[0041] There are two important points in an encryption method proposedin this specification.

[0042] First, it is important to develop a technique of preventing aneavesdropper (Eve) from extracting original information even if shesteals a quantum state. One operator randomly selected from a proper setM={U_(i)} of unitary operators is applied to an arbitrary n-qubit state|ψ> to be sent. A subscript i of each operator is a password fordecryption. Since the eavesdropper (Eve) dose not know which U_(i) isselected, the encrypted state is a statistical mixture of statesobtained by transforming |ψ> with the operators of M. M is selected tomake this statistically mixed state proportional to the identityoperator. As will be described in [Quantum Encryption Protocol] in thefirst embodiment, according to this encryption protocol, the firstpassword i is not disclosed before authentication is properly donebetween the sender and the recipient.

[0043] Second, it is important to perform authentication guaranteeingthat a quantum state is reliably transferred from the sender to therecipient. Both the sender (Alice) and the recipient (Bob) have noknowledge about the n-qubit quantum state |ψ>_(Q). If, therefore, theeavesdropper (Eve) replaces this state with another state, the senderand recipient do not notice it. From this reason, the recipient (Bob)must confirm that the received quantum state is really sent from thesender (Alice). According to the method discussed here, n-qubit |a>_(s)representing the signature of the sender (Alice) is added to U_(i)^(Q)|ψ>_(Q) and |a>_(S) and U_(i) ^(Q)|ψ>_(Q) are entangled for eachqubit. In this case, a system representing the quantum data isrepresented by Q, and a system representing the signature is representedby S. To prevent the eavesdropper (Eve) from cloning the information ofeach qubit, an operator randomly selected from L={I, H, σ_(x), Hσ_(x)}is applied to each qubit. Note that H represents Hadamardtransformation, |0> → (1/{square root}{square root over (2)})(|0>+|1>),|1> → (1/{square root}{square root over (2)})(|0>−|1>), and σ_(x)represents one of the Pauli matrices, |0> → |1>, |1> → |0>. The operatorselected from L becomes the second password for decryption.

[0044] Passwords and signatures are provided with classical bit stringsand exchanged between a sender and a recipient through a classicalchannel. An eavesdropper can also know such information.

[0045] According to the first important point described above, oneoperator randomly selected from the proper set M={U_(i)} of unitaryoperators is applied to the arbitrary n-qubit state |ψ> to be sent. Withthis operation, the following effect can be obtained. As describedabove, since the eavesdropper does not know which U_(i) is selected, theencrypted state becomes a statistically mixed state that is proportionalto the identity operator I for the eavesdropper. From this reason, theeavesdropper (Eve) cannot extract any information about |ψ> as long asshe does not know the password i. This is because, |ψ> cannot beextracted by addition of any auxiliary system, unitary transformation,and observation with respect to ρ=(½^(n))I. To obtain the information of|ψ>, therefore, the eavesdropper (Eve) must use an eavesdropping methodcapable of proper authentication.

[0046] According to the second important point described above, n-qubit|a>_(s) representing the signature of a sender is added U_(i)^(Q)|ψ>_(Q) to entangle each pair of qubits, and an operator randomlyselected from L={I, H, σ_(x), Hσ_(x)} is applied to each qubit. Withthis operation, the following effect can be obtained. The information ofeach encrypted qubit is randomly expressed by one of two types ofinconsistent bases (rectilinear basis or circular basis). If theeavesdropper (Eve) intervenes, a contradiction arises with apredetermined probability or more. This technique is essentially thesame as the eavesdropping detection technique used in BB84. This allowsthe sender (Alice) and recipient (Bob) to detect the intervention of theeavesdropper (Eve). In this method, authentication operation also servesto detect the eavesdropper (Eve).

[0047] According to the encryption method described in the firstembodiment, when quantum information to be transmitted includes n qubitsin an arbitrary state and an eavesdropper observes each of m qubits outof these n qubits independently and resends substitute qubits(Intercept/Resend attack), the probability that a sender and recipientoverlook the eavesdropper is suppressed to (¾)^(m). Assume that thestate |ψ>_(Q) to be transmitted is classical information, i.e., aproduct state |ψ>_(Q)=|0>|1>···|0> with the bases {|0>, |1>}. In thiscase, encryption by the embodiment is equivalent to performing classicalkey distribution by the one-time pad method according to the BB84protocol. Unlike quantum teleportation, if a quantum state is stolen bythe eavesdropper, the sender and recipient lose the original quantuminformation. However, it can be expected that the probability thateavesdroppers will extract quantum information is suppressed low. Noconsideration is given to safety in a case where an eavesdropper triesto carry out an eavesdropping activity using entanglement.

[0048] It is generally thought that classical random string distributionbased on quantum mechanics can be satisfactorily done by using only theuncertainty property (A. K. Ekert, “Quantum Cryptography Based on Bell'sTheorem”, Phys. Rev. Lett. 67, 661 (1991) and C. H. Bennett, G.Brassard, and N. D. Mermin, “Quantum Cryptography without Bell'sTheorem”, Phys. Rev. Lett. 68, 557 (1992)). It is conceivable that theentanglement property of quantum systems may play an important role intransmission of a quantum state as in quantum teleportation(“Teleporting an unknown quantum state via dual classic andEinstein-Podolsky-Rosen channels”, Phys. Rev. Lett. 70, 1895 (1993)).The encryption method proposed here is characterized by having the abovetwo properties.

First Embodiment

[0049] A quantum state encryption method and apparatus will be describedbelow, which have the following characteristic feature. An input means,storage means, computation means, and output means are prepared forarbitrary quantum information using qubits. In transmitting an arbitraryquantum state from a sender to a recipient through a quantum channel,the first encryption is performed to prevent an eavesdropper fromextracting original information even if the quantum state to betransmitted is stolen. A quantum state having signature information isadded to guarantee that the quantum state is really transferred from thesender to the recipient. In addition, the second encryption is performedto prevent the eavesdropper from counterfeiting the signature.

[0050] A quantum state encryption method and apparatus will be describedbelow, which are characterized by having the following first encryptionmethod. In this method, a set of proper unitary operators to be appliedto an n-qubit quantum state is prepared. An operator randomly selectedfrom this set is applied to an arbitrary n-qubit quantum state to beencrypted. This sets the density operators of the quantum state to betransmitted in a statistically mixed state from the viewpoint of theeavesdropper who does not know which operator is applied, therebypreventing the eavesdropper from extracting quantum information.

[0051] A quantum state encryption method and apparatus will be describedbelow, which are characterized by having the following first encryptionmethod. In this method, a set of a total of 4^(n) operators constitutedby n-fold tensor products of the identity operator Pauli matrices {I,σ_(x), σ_(y), σ_(z)} to be applied to one qubit is prepared. An operatorrandomly selected from this set is applied to an arbitrary n-qubitquantum state to be encrypted. This sets the density operator of thequantum state to be transmitted in the identity operator, i.e., n-qubit,statistically perfect mixture of states from the viewpoint of theeavesdropper who does not know which operator is applied, therebypreventing the eavesdropper from extracting quantum information.

[0052] A quantum state encryption method and apparatus will be describedbelow, which have the following characteristic feature. A qubitrepresenting the signature of a sender given by a classical binarystring is added to each of qubits constituting an n-qubit quantum statesubjected to first encryption in order to guarantee that a quantum stateis really transferred from the sender to the recipient. In the secondencryption method, a set of proper unitary operators to be applied tothe n-qubit quantum state having undergone first encryption and thequbit representing the signature is prepared. An operator randomlyselected from these operators is applied to the n-qubit quantum statehaving undergone the first encryption and the qubit representing thesignature to prevent the eavesdropper from counterfeiting the qubitrepresenting the signature. The recipient decrypts the received stateand observe the qubit representing the signature. That is, this methodalso serves to perform authentication and detect the intervention of theeavesdropper.

[0053] A quantum state encryption method and apparatus will be describedbelow, which have the following characteristic feature. A qubitrepresenting the signature of a sender is added to each of qubitsconstituting an n-qubit quantum state subjected to first encryption inorder to guarantee that a quantum state is really transferred from thesender to the recipient. In the second encryption method, entanglementis caused between qubits of each pair, and an operator randomly selectedfrom {I, H, σ_(x), Hσ_(x)} (where H represents Hadamard transformation,|0> → (1/{square root}{square root over (2)})(|0>+|1>), |1> → (1/{squareroot}{square root over (2)})(|0>−|1>), and σ_(x) represents one of thePauli matrices, |0> → |1>, |1> → |0>) is applied to each qubit toprevent an eavesdropper from counterfeiting the qubit representing thesignature. The recipient decrypts the received state and observes thequbit representing the signature, thereby also performing authenticationand detecting the intervention of the eavesdropper.

[0054] A quantum state encryption method and apparatus will be describedbelow, which have the following characteristic feature. According to aprocedure for cryptographic communication between a sender and arecipient, they use a classical channel through which pieces ofclassical information (bit strings) are transmitted, the pieces oftransmitted information are disclosed to allow an eavesdropper to knowthem, and the information can be copied but cannot be altered/erased,and a quantum channel through which pieces of quantum information (qubitstrings) are transmitted, and an eavesdropper can steal, observe, andalter part or all of the transmitted quantum states but cannot clone anarbitrary quantum state, and perform the following operations: (1) thesender sends an encrypted quantum to the recipient through the quantumchannel, (2) upon reception of the quantum state, the recipientdisconnects the quantum channel, and notifies the sender of thecorresponding information, (3) upon reception of the notification fromthe recipient, the sender notifies the recipient of which type ofoperation transformation for the second encryption is through theclassical channel, (4) the recipient performs inverse transformation ofthe second encryption operation notified by the sender with respect tothe received quantum state, observes a qubit representing a signature,and notifies the sender of the result through the classical channel, (5)upon reception of the signature from the recipient, the senderauthenticates the signature, and if the signature is authenticated,notifies the recipient of which type of operation transformation for thefirst encryption operation is through the classical channel, or if thesignature is not authenticated, determines the intervention of aneavesdropper and ends the communication, and (6) the recipient performsinverse transformation to the first encryption operation with respect tothe quantum state on hand to obtain final quantum information.

[0055] A quantum state encryption method and apparatus will be describedbelow, which are characterized in that a recipient performs measurementto check the presence/absence of a qubit carrying quantum information onhand to reliably determine that a quantum state is received anddisconnect the quantum channel.

[0056] The following description is organized as follows. First of all,in [Encryption of Quantum State], a technique of preventing aneavesdropper (Eve) from extracting original quantum information and anauthentication method will be described. In [Quantum EncryptionProtocol], the overall protocol will be described, and a method ofexamining whether a recipient (Bob) received a qubit will be discussed,in particular. In [Safety against Eavesdropping], attack methods thatcan be adopted by the eavesdropper (Eve) will be considered, and safetyof encryption for each method will be estimated. Note that complicatedmathematical expressions handled in [Safety against Eavesdropping] willbe examined in [Maximum Value of P_(B) When |ψ>_(Q) Is A Product State]and [Maximum Value of P_(B) When |ψ>_(Q) Is An Entangled State].

[0057]FIG. 14 is a view showing the arrangement of an encryptionapparatus according to the first and second embodiments. Referencenumeral 141 denotes an encryption apparatus on the sending side (Alice);and 142, a decryption apparatus on the receiving side (Bob).

[0058] Referring to FIG. 14, each thick arrow represents the transfer ofa quantum state (quantum information), and each thin arrow representsthe transfer of classical information. That is, in FIG. 14, a quantumchannel connecting the sending side and receiving side is expressed inthick arrows, and a classical channel connecting the sending side andreceiving side is expressed in thin arrows.

[0059] The encryption apparatus 141 on the sending side (Alice) will bedescribed first. The first encryption circuit 1412 encrypts an n-qubitto be transmitted. A signature generator 1413 generates a signature tobe added to the transmission information. The second encryption circuit1414 further encrypts the qubit which is encrypted by the firstencryption circuit 1412 and to which the signature is added. Thesedevices are controlled by a controller 1411 which is a general,classical computer.

[0060] The decryption apparatus 142 on the receiving side (Bob) will bedescribed next. A qubit counter 1422 receives a quantum state sent fromAlice and examines whether a qubit is really received. The firstdecryption circuit 1423 decrypts the received quantum state. A signaturedetector 1424 detects a signature by observing the contents decrypted bythe first decryption circuit 1423. The second decryption circuit 1425decrypts the portion obtained by subtracting the signature from thecontents decrypted by the first decryption circuit 1423. The finaln-qubit quantum information is obtained as an output from the firstdecryption circuit 1423. These devices are controlled by a controller1421 which is a general, classical computer.

[0061] The encryption circuits 1412 and 1414, decryption circuits 1423and 1425, signature generator 1413, signature detector 1424, and qubitcounter 1422 for examining whether a qubit is really received aredevices designed to handle quantum states, and hence need to be able to,for example, hold, transform, observe, and initialize qubits. Thearrangements of these devices will be described in further detail laterin the third and forth embodiments.

[0062]FIG. 15 is a view showing procedures in a quantum state encryptionmethod according to the first embodiment. Reference numeral 151 denotesan encryption procedure on the sending side (Alice); and 152, adecryption procedure on the receiving side (Bob).

[0063] Referring to FIG. 15, each thick arrow represents the transfer ofa quantum state (quantum information), and each thin arrow representsthe transfer of classical information. That is, in FIG. 15, a quantumchannel connecting the sending side and receiving side is expressed inthick arrows. In addition, each thin arrow externally entering thedecryption procedure 152 (from Alice) and extending outward (to Alice)represents the transfer of classical information through a classicalchannel connecting the sending side and receiving side.

[0064] The encryption procedure 151 on the sending side (Alice) will bedescribed first. In the encryption procedure 151, the first encryptionprocessing 1511 (U_(i) ^(Q)) is performed for the n-qubit quantum state(|ψ>_(Q)) to be transmitted by using a 2n-bit random string i to obtain(U_(i) ^(Q)|ψ>_(Q)). In signature generation 1512, n-qubits (|0>_(S))initialized as ground state is transformed into a quantum system(|a>_(S)) representing a signature by using an n-bit random string a.

[0065] Each symbol indicated by the circle in FIG. 15 represents aprocedure for generating a random string constituted by classical bits,which can be obtained by using a random number generated by a general,classical computer or a random number table prepared individually on thesending side (Alice) in advance.

[0066] The sending side (Alice) couples these two quantum systems (U_(i)^(Q)|ψ>_(Q)) and (|a>_(S)) (couples them as tensor product states; thisoperation is equivalent to simply placing n-qubits having the originalquantum information and n-qubits representing the signature side byside). The second encryption processing 1513 (V_(α) ^(QS)) is performedfor this coupled result (|a>_(S) {circle over (×)} U_(i) ^(Q)|ψ>_(Q)) byusing a 4n-bit random string α. The sending side (Alice) transmits the2n-qubit state (V_(α) ^(QS)[|a>_(S) {circle over (×)} U_(i)^(Q)|ψ>_(Q)]), obtained by these operations to the receiving side (Bob)through a quantum channel.

[0067] The decryption procedure 152 on the receiving side (Bob) will bedescribed next. The receiving side (Bob) performs measurement (a kind ofmeasurement of the number of qubits, which is performed by the qubitcounter in FIG. 15) 1521 with respect to the 2n-qubit state (V_(α)^(QS)[|α>_(S) {circle over (×)} U_(i) ^(Q)|ψ>_(Q)]) sent from thesending side (Alice) to confirm the arrival of qubits, and notifies thesending side (Alice) that expected 2n-qubit was really received. Thereceiving side then performs first decryption (inverse transformation(V_(α) ^(QS))⁻¹ for the second encryption) 1522 by using the second4n-bit password α received from the sending side (Alice). After thedecryption, 2n-qubit |a>_(S) {circle over (×)} U_(i) ^(Q)|ψ>_(Q) isseparated into n-qubit U_(i) ^(Q)|ψ>_(Q) having the original quantuminformation and n-qubit |a>_(S) representing the signature. Thereceiving side (Bob) performs observation 1523 of the signature qubit(|a>_(S)), and notifies the sending side (Alice) of the result. Finally,the receiving side obtains the original n-qubit quantum information(|ψ>_(Q)) by performing the second decryption (inverse transformation(U_(i) ^(Q))⁻¹ for the first encryption) 1524 by using the first 2n-bitpassword i.

[0068] The first and second encryption procedures and the procedures forexchanging information through classical and quantum channels will bedescribed in detail in [Encryption of Quantum State] and [QuantumEncryption Protocol].

[0069] [Encryption of Quantum State]

[0070] A technique of preventing an eavesdropper (Eve) from extractingoriginal quantum information and a method of performing authenticationbetween a sender (Alice) and a recipient (Bob) will be described.

[0071] A method of properly transforming an arbitrary quantum state andpreventing Eve from reconstructing the original state will be consideredfirst. For the sake of simplicity, consider, for a while, a case wherean arbitrary 1-qubit state is encrypted. This state is represented by adensity operator ρ. Assume that ρ represents an arbitrary densityoperator in a two-dimensional Hilbert space H₂ formed by qubits, andAlice has no knowledge about ρ. This is because, even partialobservation by Alice will destroy the state.

[0072] Alice encrypts ρ by using a classical binary string password toprevent Eve from extracting the original information about ρ even if shesteals the qubit. Assume that Alice does not let others know thepassword. Alice may use the following method. First of all, she preparesthe following set of operators:

M={σ_(j):j=0, x, y, z}

[0073] where σ₀=I and {σ_(x), σ_(y), σ_(z)} are Pauli matrices, and theyare expressed as ${I = \begin{pmatrix}1 & 0 \\0 & 1\end{pmatrix}},{\sigma_{x} = \begin{pmatrix}0 & 1 \\1 & 0\end{pmatrix}},{\sigma_{y} = \begin{pmatrix}0 & {- i} \\i & 0\end{pmatrix}},{\sigma_{2} = \begin{pmatrix}1 & 0 \\0 & {- 1}\end{pmatrix}}$

[0074] with respect to a bases given by${{| 0 \rangle} = \begin{pmatrix}1 \\0\end{pmatrix}},{| {{1\quad}\rangle}  = \begin{pmatrix}0 \\1\end{pmatrix}}$

[0075] The operators belonging to the set M may be disclosed. Alicerandomly selects one operator σ_(i) from M, and performs unitarytransformation represented by

ρ → σ_(i)ρσ_(i) ^(†)

[0076] Assume that Alice uses the subscript i as a password and does notlet others known it. Since there are four types of operators, thepassword is given by 2-bit classical information.

[0077] If, for example, Eve steals the qubit, since Eve does not knowwhat kind of transformation Alice performed, Eve obtains$\rho^{\prime} = {\frac{1}{4}{\sum\limits_{{j = 0},x,y,z}{\sigma_{j}{\rho\sigma}_{j}^{\dagger}}}}$

[0078] In general, ρsatisfies ρ^(†)=ρ, Trρ=1, 0≦λ₁, λ₂≦1 and λ₁+λ₂=1,where λ₁ and λ₂ are the eigenvalues of ρ are λ₁ and λ₂. Therefore,arbitrary ρ is given by ρ=½(I+a·σ), where a=(a₁, a₂, a₃) is a3-component real vector and 0≦Σ_(k=1) ³α_(k) ²≦1.

[0079] Since $\begin{matrix}{\rho^{\prime} = {{\frac{1}{2}I} + {\frac{1}{8}{\sum\limits_{{j = 0},x,y,z}{{a \cdot \sigma_{j}}{\sigma\sigma}_{j}^{\dagger}}}}}} & (1)\end{matrix}$

[0080] and ${\sigma_{j}\sigma_{k}\sigma_{j}} = \{ \begin{matrix}\sigma_{k} & {j = {{0\quad {or}\quad j} = k}} \\{- \sigma_{k}} & {{j \neq {k\quad {and}\quad j}},{k \in \{ {x,y,z} \}}}\end{matrix} $

[0081] the second term of (1) is canceled out to obtain$\rho^{\prime} = {\frac{1}{2}I}$

[0082] Even if, therefore, Eve obtains ρ′, she can extract noinformation about ρ as long as she does not know the password i.

[0083] In general, an arbitrary density operator ρ_(n) of an n qubits isgiven by$\rho_{n} = {\frac{1}{2^{2}}( {I + {\sum\limits_{{k \in {\{{0,x,y,z}\}}^{n}},{k \neq {({0,\ldots \quad,0})}}}{a_{k}U_{k}}}} )}$

[0084] where

U _(k)=σ_(k) _(i) {circle over (×)}···{circle over (×)} σ_(k) _(n)

[0085] and a_(k)(kε{0,x,y,z}^(n) and k≠(0, . . . , 0)) are real numbers.In this case, if Alice encrypts ρ_(n) like ρ_(n) → U_(i)ρ_(n)σ_(i) ^(†)by using U_(i) randomly selected from

M _(n) ={U _(k) :U _(k)=σ_(k) _(i) {circle over (×)}···{circle over (×)}σ_(k) _(n) , k ε{0,x,y,z}^(n)}  (2)

[0086] Eve receives the following state: $\begin{matrix}\begin{matrix}{\rho_{n}^{\prime} = {\frac{1}{4^{n}}{\sum\limits_{j \in {({0,x,y,z})}^{n}}{U_{j}\rho_{n}U_{j}^{\dagger}}}}} \\{= {{\frac{1}{2^{n}}I} + {\frac{1}{4^{n} \cdot 2^{n}}{\sum\limits_{j,{k \in {{{\{{0,x,y,z}\}}^{n}k} \neq {({0,\ldots \quad,0})}}}}{a_{k}U_{j}U_{k}U_{j}^{\dagger}}}}}} \\{= {\frac{1}{2^{n}}I}}\end{matrix} & (3)\end{matrix}$

[0087] That is, Eve cannot steal information about ρ_(n). No matter howEve performs addition of an auxiliary system, unitary transformation,and observation, she cannot extract ρ_(n). The password i is given by a2n-bit string.

[0088] An authentication method will be described next. Eve may stealρ′_(n) and send a completely arbitrary state {tilde over (ρ)}_(n) as acounterfeit to Bob. Even if Bob applies the inverse transformation like{tilde over (ρ)}_(n) → U_(i){tilde over (ρ)}_(n)U_(i) ^(†), he does notnotice that {tilde over (ρ)}_(n) is the counterfeit. This is because,Alice and Bob have no knowledge about the original state ρ_(n).

[0089] A kind of signature is set in ρ_(n) to allow Bob to confirm thatthe received data is ρ_(n) which is really sent from Alice in decodingit. In this case, some kind of technique of preventing Eve fromcounterfeiting the signature is required. For the sake of simplicity,consider a state ∀|ψ>_(Q) ε H₂ ^(n) instead of the density operatorρ_(n). The above discussion holds even if the n-qubit state to beencrypted is a mixed state. Let Q be a system having quantuminformation, and S be a system representing a signature.

[0090] A signature is placed as follows. First of all, Alice prepares ann-bit random string ∀a=(a₁, . . . , a_(n)) ε {0,1}^(n) and adds a qubit|a_(ki)>_(S) to the kth qubit in $\begin{matrix}{{{{{( { U_{i}^{Q} \middle| \Psi \rangle} )_{Q} = {\sum\limits_{x \in {\{{0,1}\}}^{n}}{c_{x} \quad \middle| x_{l} }}}\rangle}\quad \ldots \quad  \quad \middle| x_{n} }\rangle} \in H_{2}^{n}} & (4)\end{matrix}$

[0091] As shown in FIG. 2, a controlled-NOT gate is effected to performtransformation as follows:

|x_(k)>_(Q)|a_(k)>_(S)→|x_(k)>_(Q)|a_(k)⊕x_(k) mod 2>_(S) for k=1, . . ., n

[0092] Operators L_(k,1) ^(Q) and L_(k,2) ^(S) ε L randomly selectedfrom L={I, H, σ_(x), Hσ_(x)} are independently applied to two qubits,where, $H = {\frac{1}{\sqrt{2}}\begin{pmatrix}1 & 1 \\1 & {- 1}\end{pmatrix}}$

[0093] Assume that these operations are performed for the k(=1, . . . ,n)th qubit, and the overall transformation is written V_(α) ^(QS) whereα represents which operator is selected from L. In addition, α is thesecond password represented by a 4n-bit string.

[0094] Note that operation for qubits will be often expressed by anetwork diagram, as shown in FIG. 2. Assume that a qubit is written inlateral line, and operation proceeds from left to right. For example,unitary transformation applied to qubits are expressed as shown in FIGS.3A and 3B. FIG. 3A shows a controlled-NOT (C-NOT) gate, and FIG. 3Bshows σ_(x). These expression methods are based on R. P. Feynman,“Feynman Lectures on Computation”, Addison-Wesley (1996) and A. Barenco,C. H. Bennett, R. Cleve, D. P. DiVincenzo, N. Margolus, P. Shor, T.Sleator, J. Smolin, and H. Weinfurter, “Elementary gates for quantumcomputation”, Phys. Rev. A 52, 3457 (1995).

[0095] The procedures for encryption described so far will be summarizedas follows:

|Ψ>_(Q) →U _(i) ^(Q)|Ψ>_(Q) (1st password i) →|a> _(x) {circle over(×)}U _(i) ^(Q)|Ψ>_(Q) (signature a) →V _(α) ^(QS)[|a> _(s) {circle over(×)}U _(i) ^(Q)|Ψ>_(Q)](2nd password α)   (5)

[0096] If encryption is performed doubly in this manner, Eve cannotsteal the state, extract only |a>_(S), or use it fraudulently. If V_(α)^(QS) is not applied, Eve may steal U_(i) ^(Q)|ψ>_(Q) and send acounterfeit |a>_(S) {circle over (×)} |{tilde over (ψ)}>_(Q) to Bob.

[0097] If Eve applies some operation to the kth qubit of the system Q,the signature portion |a_(k)>_(S) is destroyed, and Bob cannot properlyperform authentication with a certain probability. The same applies to acase where Eve operates the kth qubit of the system S. This is because,the systems Q and S are expressed by two types of bases {|0>,|1>} and{(1/{square root}{square root over (2)})(|0>±|1>)}, and they areentangled with each other. The probability that the intervention of Evewill be detected by Alice and Bob will be considered in [Safety againstEavesdropping].

[0098] [Quantum Encryption Protocol]

[0099] Consider a procedure for sending unknown arbitrary quantum data|ψ>_(Q) from Alice to Bob by using the encryption method discussed inthe preceding item. A problem is set as follows. Assume that Alice wantsto send ∀|ψ>_(Q) ε H₂ ^(n) to Bob without letting Eve eavesdrop it, andAlice and Bob have no knowledge about |ψ>_(Q). Assume that each of Aliceand Bob can use two types of channels:

[0100] Classical Channel

[0101] This channel is used to transmit/receive classical information(bit string). The information is disclosed, and Eve can know it.Although the information can be copied, it cannot be altered and erased.This medium is equivalent to the newspaper, radio and so on.

[0102] Quantum Channel

[0103] This channel is used to transmit/receive quantum information(qubit string). Eve can steal, observe, and alter some or all of aquantum state, but cannot clone an arbitrary quantum state.

[0104] Alice and Bob communicate with each other according to thefollowing procedure (see FIG. 1):

[0105] 1. Alice sends V_(α) ^(QS)[|a>_(S) {circle over (×)} U_(i)^(Q)|ψ>_(Q)] (≡|ψ_(crypt)>) to Bob.

[0106] 2. Upon reception of the quantum state |ψ_(crypt)>, Bobdisconnects the quantum channel and notifies Alice of the correspondinginformation.

[0107] 3. Upon reception of the notification from Bob, Alice notifiesBob of which type of transformation (α: 4n-bit) V_(α) ^(QS) is throughthe classical channel.

[0108] 4. Bob observes the system S by applying V_(α) ^(QS†) to|ψ_(crypt)> and notifies Alice of the result (a: n-bit) through theclassical channel.

[0109] 5. Alice receives a signature from Bob and authenticates it. Ifthe signature is correct, Alice notifies Bob of which type oftransformation (i: 2n-bit) U_(i) ^(Q) is through the classical channel.If the signature is not correct, Alice determines that Eve hasintervened, and ends the communication.

[0110] 6. Bob obtains |ψ>_(Q) by applying U_(i) ^(Q†) to the quantumstate on hand.

[0111] In this procedure, the second item is important, in which Bobdisconnects the quantum channel upon determining the reception of|ψ_(crypt)>, from the following reason (see FIG. 4). Assume that Boberroneously notified Alice of the arrival of |ψ_(crypt)> midway alongthe quantum channel, and Alice disclosed V_(α) ^(QS†) through theclassical channel. The eavesdropper Eve can steal |ψ_(crypt)> and obtain|a>_(S) {circle over (×)} U_(i) ^(Q)|ψ>_(Q) by applying V_(α) ^(QS†) to|ψ_(crypt)>. Eve can leave U_(i)|ψ>_(Q) on hand and send V₆₀^(QS)[|a>_(S) {circle over (×)} U_(i) ^(Q)|{tilde over (ψ)}>_(Q)]obtained by coupling |a>_(S) to the counterfeit quantum state |{tildeover (ψ)}>_(Q) to Bob. If Bob still holds the quantum channel andreceives V_(α) ^(QS)[|a>_(S) {circle over (×)} U_(i) ^(Q)|{tilde over(ψ)}>_(Q)], since the authentic signature is placed, Alice and Bobcannot detect the presence of Eve. Alice then discloses U_(i) ^(Q), andEve obtains |ψ>_(Q) at the end.

[0112] To avoid such a danger, Bob must determine that he really hasreceived |ψ_(crypt)> or the quantum state formed by Eve.

[0113] For example, the quantum gate network shown in FIG. 5 may beprepared (D. Gottesman, “Stabilizer Codes and Quantum Error Correction”,Ph. D. thesis, California Institute of Technology, LANL quantum physicsarchive quant-ph/9705052). Assume that while the 1st-qubit and 2nd-qubitare in a general entangled state |ψ>_(Q), it is to examine thepresence/absence of the 1st-qubit by using an auxiliary qubit system A.Assume that the overall system is written${{ {( {{{{\Psi}\rangle}}0} \rangle} )_{A} = {\sum\limits_{i,{j \in {\{{0,1}\}}}}{{c_{ij}( {{i}\rangle} )}_{2}( {{j}\rangle} )_{1}{0}}}}\rangle}_{A}$

[0114] In this case, |ψ>_(Q)|0>_(A) is transformed into$ {( {{( {{\Psi}\rangle} )_{Q}}0} \rangle} )_{A} = {( {{\sum\limits_{i}{ ( {{( {{( {{( {( {c_{i0}{i}} \rangle} )_{2}{0}}\rangle} )_{1} + {c_{i1}{i}}}\rangle} )_{2}{1}}\rangle} )_{1} ){0}}}\rangle} )_{A}\overset{{step}\quad 1}{arrow}{ {( {{\sum\limits_{i}{ ( {{( {{( {{( {{( {( {c_{i0}{i}} \rangle} )_{2}{1}}\rangle} )_{1}{0}}\rangle} )_{A} + {c_{i1}{i}}}\rangle} )_{2}{0}}\rangle} )_{1} ){1}}}\rangle} )_{A}\quad} )\overset{{step}\quad 2}{arrow}{( {{\sum\limits_{i}{ ( {{( {{( {{( {( {c_{i0}{i}} \rangle} )_{2}{0}}\rangle} )_{1} + {c_{i1}{i}}}\rangle} )_{2}{1}}\rangle} )_{1} ){1}}}\rangle} )_{A}{\quad \quad {= ( {{( {{\Psi}\rangle} )_{Q}{1}}\rangle} )_{A}}}}}}$

[0115] If, therefore, the measurement to examine the presence/absence ofa qubit as in FIG. 5 is performed with respect to each channel throughwhich a qubit is transferred to Bob, it can be examined whether allqubits have arrived.

[0116] [Safety against Eavesdropping]

[0117] It is difficult to assume all eavesdropping methods that Eve cantake. In this case, therefore, assume that Eve tries to perform only theIntercept/Resend attack of independently observing each qubittransmitted with a proper basis and sending a substitute qubit inaccordance with the result (C. H. Bennett, F. B. Bessette, G. Brassard,L. Salvail and J. Smolin, “Experimental Quantum Cryptography”, J.Cryptology, 5: 3-28 (1992)). Consideration should be given to thefollowing. Since a density operator in an encrypted state is keptproportional to I unless Eve knows the password i of first encryptionU_(i) ^(Q)|ψ>_(Q), Eve cannot extract information about |ψ>_(Q). Evemust therefore let Alice disclose the first password i. Here, theprobability that Alice and Bob cannot detect eavesdropping by Eve isestimated.

[0118] To simplify the problem, assume, for a while, that |ψ>_(Q) is ann-qubit product state. In the first encryption, Alice applies ∀U_(i)^(Q)=σ_(i) ₁ {circle over (×)}···{circle over (×)} σ_(in) to|ψ>_(Q)=|Ψ₁> {circle over (×)}···{circle over (×)}|Ψ_(n)>. Therefore,U_(i) ^(Q)|ψ>_(Q) is also a product state, and each qubit may beconsidered independently.

[0119] Assume that the k(k=1, . . . , n)th qubit of U_(i) ^(Q)|ψ>_(Q) iswritten |Ψ>_(Q)=α|0>_(Q)+β|1>_(Q), and the kth signature qubit iswritten |a>_(S)(aε{0,1}). The state sent by Alice at time t=0 in FIG. 6is given by

αL₁|0>_(Q)L₂|a>_(S)+βL₁|1>_(Q)L₂|a⊕1>_(S)

[0120] At t=τ, Bob observes only the system S. If |a>_(S) is obtained,Bob determines that proper authentication is done. This means that Bobperforms observation with the projection operator given by

Π_(L) ₁ _(L) ₂ ^(QS)=(L ₁|0><0|L ₁ ^(t))_(Q){circle over (×)}(L ₂|a><a|L ^(t) ₂)_(s)+(L ₁|1><1|L ₁ ^(t))_(Q){circle over (×)}(L ₂|a⊕1><a⊕1|L ₂ ^(t))_(s)

[0121] Assume that Eve tried to eavesdrop only a qubit of the system S,and the system S. The system S which was in a density operator ρ^(S) att=0 evolved into $(ρ^(S)) where $ is a completely positive map thatdescribes how Eve made Intercept/Resend attack against the system S (B.Schumacher, “Sending entanglement through noisy quantum channels”, Phys.Rev. A54, 2614 (1996)). As a consequence, at t=τ, the state of systems Qand S is given by

ρ_(L) ₁ _(,L) _(s) ^(QS)(τ)=|α|²(L ₁|0><0|L ₁ ^(t))_(Q){circle over(×)}$(L ₂ |a><a|L _(s) ^(t))_(s)+αβ*(L ₁|0><1|L ₁ ^(t))_(Q){circle over(×)}$(L ₂ |a><a⊕1|L ₂ ^(t))_(s)+βα*(L ₁|1><0|L ₁ ^(t))_(Q){circle over(×)}$(L ₂ |a⊕1><a/L ₂ ^(t))_(s)+|β|²(L ₁|1><1|L ₁ ^(t))_(q){circle over(×)}$(L ₂ |a><a⊕1|L _(w) ^(t))_(s)

[0122] The probability P that Bob will obtain |a>_(s) is given by

P=Tr _(QS)[ρ_(L) ₁ _(,L) ₂ ^(QS)(τ)Π_(L) ₁ _(1L) ₂ ^(QS)]=|α|² <a|L ₂^(t)$(L ₂ |a><a|L ₂ ^(t))L ₂ |a>+|β| ² <a⊕1|L ₂ ^(t)$ (L ₂ |a⊕1><a⊕1|L ₂^(t)(L ₂ |a⊕1>  (6)

[0123] This means that even if the initial state |Ψ>_(Q) of the system Qis superposition of |0> and |1>, it can be regarded as a classicalstatistical mixture of |Ψ>_(Q)=|0> and |Ψ>_(Q)=|1>) in obtaining P.

[0124] The probability that Bob will successfully perform authenticationis equal to the probability that an output will become |φ>_(S) withrespect to the input |φ>_(S)=L₂|0>_(S) of the system S in a quantum gatecircuit like the one shown in FIG. 7. Note that this probability isobtained by averaging all L₂ ε L. In the quantum gate network shown inFIG. 7, the probability that Bob will successfully performauthentication is calculated. U and V represent unitary transformationapplied to one qubit, and U is defined as

U|Ψ ₀>=|0>, U|Ψ ₁>=|1>

[0125] with {|Ψ₀>, |Ψ₁>} being the normal orthonormal basis of H₂.Assume that |φ>=c₀|Ψ₀>+c₁|Ψ₁>. Evolution of the state in the network inFIG. 7 can be written as: $\begin{matrix}{ {{{{{{ {{{{{{{\varphi}\rangle}_{S}{0}}\rangle}_{E} = { {{{( {c_{0}{\phi_{0}}} \rangle}_{S} + {c_{1}{\phi_{1}}}}\rangle}_{S} ){0}}}\rangle}_{E}\overset{\quad U\quad}{arrow}\quad ( {{c_{0}{0\rangle}_{S}} + {c_{1}{1}}}\rangle _{S}} ){0\rangle}_{E}}\quad \overset{C - {NOT}}{arrow}\quad {{c_{0}{0\rangle}_{S}{0\rangle}_{E}} + {c_{1}{1}}}}\rangle}_{S}{1\rangle}_{E}}\overset{\quad V\quad}{arrow}\quad {{c_{0}V{0\rangle}_{S}{0\rangle}_{E}} + {c_{1}V{1}}}}\rangle}_{S} ){1\rangle}_{E}} & (7)\end{matrix}$

[0126] This operation is equivalent to letting Eve observe an encryptedqubit with a basis {|Ψ₀>, |Ψ₁>} and sending a basis {V|0>,V|1>}according to the observation result. The probability that Bob willobserve the signature concerning |φ>_(S) in spite of the intervention ofEve is given by

P _(φ) =|c ₀|² |>φ|V|0>|² +|c ₁|² |>φ|V|1>|²  (8)

[0127] For the sake of simplicity, the probability will be expressed byusing density operators hereinafter.${{{\rho_{\varphi} = {{\varphi\rangle}{\langle{ \varphi |,{{\overset{\sim}{\rho}}_{0} = {{\phi_{0}\rangle}{\langle\phi_{0}}}},{{\overset{\sim}{\rho}}_{1} = {{\phi_{1}\rangle}{\langle\phi_{1}}}},{{\overset{\sim}{\rho}}_{0}^{\prime} =  V \middle| 0 }}\rangle}{\langle 0}V^{\dagger}}},{{\overset{\sim}{\rho}}_{1}^{\prime} =  V \middle| 1 }}\rangle}{\langle 1 \middle| V^{\dagger} }$

[0128] Mathematical expression (7) can be rewritten$ \rho_{\varphi}arrow{\$ ( \rho_{\varphi} )}  = {{( {{Tr}\quad \rho_{\varphi}{\overset{\sim}{\rho}}_{0}} ){\overset{\sim}{\rho}}_{0}^{\prime}} + {( {{Tr}\quad \rho_{\varphi}{\overset{\sim}{\rho}}_{1}} ){\overset{\sim}{\rho}}_{1}^{\prime}}}$

[0129] Equation (8) can be rewritten

P _(φ)=Tr[$(ρ_(φ))ρ_(φ)]

[0130] The following four types of density operators L₂|0><0|L₂^(†)(L₂εL) are transmitted as |φ>_(S) with equal probability: ρ ↕ = 1 2 ( I + σ z ) , p ↔ = 1 2  ( I + σ z ) , ρ = 1 2  ( I + σ x ) ,  ρ =1 2  ( I + σ x )

[0131] And we assume${{\overset{\_}{\rho}}_{i} = {\frac{1}{2}\lbrack {I + {( {- 1} )^{i}{X \cdot \sigma}}} \rbrack}},{{\overset{\_}{\rho}}_{j}^{\prime} = {\frac{1}{2}\lbrack {I + {( {- 1} )^{j}{X^{\prime} \cdot \sigma}}} \rbrack}}$for  i, j ∈ {0, 1}

[0132] where X=(X,Y,Z) and X′=(X′,Y′,Z′) are 3-component real vectorsand satisfy |X|²=|X′|²=1. With the use of

Tr(I+A·σ)(I+B·σ)=2(1+A·B)

[0133] a probability P_(B) that Bob will properly observe a signature inspite of the intervention of Eve is given as follows by averaging fourvalues P_(φ.) P B = 1 4  ( P ↕ + P ↔ + P + P = 1 4  ( 2 + XX ′ + ZZ ′) ≤ 3 4 ( 9 )

[0134] The probability that Alice and Bob will overlook the interventionof Eve using the network in FIG. 7 does not exceed ¾. The same isapplied to a case where Eve makes Intercept/Resend attack against thesystem Q. This means that the probability that Alice and Bob willoverlook the presence of Eve is as low as (¾)^(m) where m is the numberof qubits in which Eve intervened.

[0135] Consider a case where Eve makes Intercept/Resend attack againsteach qubit in the systems Q and S independently. Upon observation ofρ^(QS) sent from Alice, Eve sends a state ρ^(QS′) given below to Bob:${\rho^{{QS}^{\prime}} = {{\$ ( \rho^{QS} )} = {\sum\limits_{i,{j \in {\{{0,1}\}}}}{{{Tr}( {{\rho^{QS}{\overset{\sim}{\rho}}_{Q}},{i\quad {\overset{\sim}{\rho}}_{s,j}}} )}{\overset{\sim}{\rho}}_{Q}^{\prime}}}}},{\overset{\sim}{\rho}}_{s,j}^{\prime}$

[0136] where $\begin{matrix}{{{\overset{\sim}{\rho}}_{Q,i} = {{{{{{U_{1}^{\dagger}{i}}\rangle}{\langle i}}}U_{1}} = {( {1/2} )\quad\lbrack {I + {( {- 1} )^{i}{X_{1} \cdot \sigma}}} \rbrack}}}{{\overset{\sim}{\rho}}_{s,j} = {{{{{{U_{2}^{\dagger}{j}}\rangle}{\langle j}}}U_{2}} = {( {1/2} )\quad\lbrack {I + {( {- 1} )^{j}{X_{2} \cdot \sigma}}} \rbrack}}}{{\overset{\sim}{\rho}}_{Q,i} = {{{{{{V_{1}{i}}\rangle}{\langle i}}}V_{1}^{\dagger}} = {( {1/2} )\quad\lbrack {I + {( {- 1} )^{i}{X_{3} \cdot \sigma}}} \rbrack}}}{{\overset{\sim}{\rho}}_{s,j} = {{{{{{V_{2}{j}}\rangle}{\langle j}}}V_{2}^{\dagger}} = {( {1/2} )\quad\lbrack {I + {( {- 1} )^{j}{X_{4} \cdot \sigma}}} \rbrack}}}} & (10)\end{matrix}$

[0137] and |X_(k)|²=1 (k=1, . . . , 4).

[0138] Even if |a>_(S) is |0>_(S), generality is not lost. Assume alsothat the state of the system Q to be transmitted is |Ψ>_(Q)=α|0>+β|1>.Since Alice has 16 ways of applying L₁ and L₂εL, the probability thatBob will make final authentication is given by $\begin{matrix}{P_{B} = {\frac{1}{16}{\sum\limits_{L_{1},{L_{2} \in L}}{{Tr}\lbrack {{\$ ( \rho_{L_{1},L_{2}}^{QS} )}\prod\limits_{L_{1}L_{2}}^{QS}} \rbrack}}}} & (11)\end{matrix}$

[0139] where ρ_(L) ₁ ^(Q) _(L) ₂ ^(S) is the density operator of thestate αL₁|0>_(Q)L₂|0>_(S)+βL₁|1>_(Q)L₂|1>_(S), which is explicitlywritten

ρ_(L) ₁ _(L) ₂ ^(QS)=|α|²(L ₁|0><0|L ₁ ⁵)_(Q){circle over (×)}(L₂|0><0|L ₂ ^(t))₂+αβ*(L ₁|0><1|L ₁ ^(t))_(Q){circle over (×)}(L ₂|0><1|L₂ ^(t))_(s)+βα*(L ₁|1><0|L ₁ ^(t))_(Q){circle over (×)}(L ₂|1><0|L ₂^(t))_(s)|β|²(L ₁|1><1|L ₁ ^(t))_(Q){circle over (×)}(L ₂|1><1|L ₂^(t))_(s)   (12)

[0140] In addition,

Π_(L) ₁ _(,L) ₂ ^(QS)=(L ₁|0><0|L ₁ ^(t))_(Q){circle over (×)}(L₂|0><0|L ₂ ^(t))_(s)+(L ₁|1><1|L ₁ ^(t))_(Q){circle over (×)}(L ₂|1><1|L₂ ^(t))_(s)

[0141] Equation (11) is linear for ρ_(L) ₁ _(,L) ₂ ^(QS). No problemtherefore arises even if the respective terms of equation (12) areseparately calculated.

[0142] First of all, consider the first and fourth terms. Assume that

l_(L) ₁ _(,L) ₂ ^(QS)=(L ₁|0><0|L ₁ ^(†))_(Q){circle over (×)}(L₂|0><0|L ₂ ^(†))_(s)   (13)

[0143] If L₁=L₂=I, then

l _(I,I) ^(QS)=(¼)[I+σ _(z)]_(Q){circle over (×)}[I+σ _(z)]_(s)

Π_(I,I) ^(QS)=(¼)[(I+σ _(z))_(Q){circle over (×)}(I+σ _(z))_(s)+(I−σ_(z))_(Q){circle over (×)}(I−σ _(z))_(s)

[0144] Therefore,

Tr[S(l _(I,I) ^(QS))Π_(I,I) ^(QS)]=(½)(1+Z ₁Z₂Z₃Z₄)

[0145] By similar calculation, the following is obtained:${{Tr}\lbrack {{\$ ( l_{L_{1},L_{2}}^{QS} )}\prod\limits_{L_{1},L_{2}}^{QS}} \rbrack} = \{ \begin{matrix}{(1.2)( {1 + {Z_{1}Z_{2}Z_{3}Z_{4}}} )} & {{{for}\quad L_{1}},{L_{2} \in \{ {I,\sigma_{x}} \}}} \\{( {1/2} )( {1 + {X_{1}X_{2}X_{3}X_{4}}} )} & {{{for}\quad L_{1}},{L_{2} \in \{ {H,{H\quad \sigma_{x}}} \}}} \\{( {1/2} )( {1 + {Z_{1}X_{2}Z_{3}X_{4}}} )} & {{{for}\quad L_{1}} \in \{ {I,\sigma_{x}} \} \in \{ {H,{H\quad \sigma_{x}}} \}} \\{( {1/2} )( {1 + {X_{1}Z_{2}X_{3}Z_{4}}} )} & {{{{for}\quad L_{1}} \in \{ {H,{H\quad \sigma_{x}}} \}},{L_{2} \in \{ {I,\sigma_{x}} \}}}\end{matrix} $

[0146] Therefore,${\frac{1}{16}{\sum\limits_{L_{1},L_{2}}{{Tr}\lbrack {\$ \quad ( l_{L_{1},L_{2}}^{QS} )\prod\limits_{L_{1},L_{2}}^{QS}} \rbrack}}} = {\frac{1}{2} + {\frac{1}{8}( {{X_{1}X_{3}} + {Z_{1}Z_{3}}} )( {{X_{2}X_{4}} + {Z_{2}Z_{4}}} )}}$

[0147] Consider next the second and third terms. Assume that

Δl _(L) ₁ _(,L) ₂ ^(QS)=(L ₁|0><1|L ₁ ^(t))_(Q){circle over (×)}(L₂|0><1|L ₂ ^(t))_(s)

[0148] If, for example, L₁=L₂=I, then

Δl _(I,I) ^(QS)=(¼)(σ_(x) +iσ _(y))_(Q){circle over (×)}(σ_(x) +iσ_(y))_(s)

Tr[$(Δl _(I,I) ^(QS))Π_(I,I) ^(QS)]=(½)(X ₁ +iY ₁)(X ₂ +iY ₂)Z ₃ Z ₄

[0149] Similarly,${{Tr}\lbrack {\$ \quad ( l_{L_{1},L_{2}}^{QS} )\prod\limits_{L_{1},L_{2}}^{QS}} \rbrack} = \{ \begin{matrix}{\quad {{{{{( {1/2} )\lbrack {{X_{1} + i} \in Y_{1}} \rbrack}\lbrack {{X_{2} + i} \in Y_{2}} \rbrack}Z_{3}Z_{4}\quad ( {L_{1},L_{2}} )} = ( {I,I} )},}} & ( {\sigma_{x},\sigma_{x}} ) \\{{{- {{( {1/2} )\lbrack {{X_{1} + i} \in Y_{1}} \rbrack}\lbrack {{X_{2} - i} \in Y_{2}} \rbrack}}Z_{3}{Z_{4}( {I,\sigma_{x}} )}},} & ( {\sigma_{x},I} ) \\{\quad {{{{( {1/2} )\lbrack {{Z_{1} - i} \in Y_{1}} \rbrack}\lbrack {{Z_{2} - i} \in Y_{2}} \rbrack}X_{3}{X_{4}( {H,H} )}},}} & ( {{H\quad \sigma_{x}},{H\quad \sigma_{x}}} ) \\{{{- {{( {1/2} )\lbrack {{Z_{1} - i} \in Y_{1}} \rbrack}\lbrack {{Z_{2} + i} \in Y_{2}} \rbrack}}X_{3}X_{4}\quad ( {H,{H\quad \sigma_{x}}} )},} & ( {{H\quad \sigma_{x}},H} ) \\{\quad {{{{( {1/2} )\lbrack {{X_{1} + i} \in Y_{1}} \rbrack}\lbrack {{Z_{2} - i} \in Y_{2}} \rbrack}Z_{3}{X_{4}( {I,H} )}},}} & ( {\sigma_{x},{H\quad \sigma_{x}}} ) \\{{{- {{( {1/2} )\lbrack {{X_{1} + i} \in Y_{1}} \rbrack}\lbrack {{Z_{2} + i} \in Y_{2}} \rbrack}}Z_{3}{X_{4}( {I,{H\quad \sigma_{x}}} )}},} & ( {\sigma_{x},H} ) \\{\quad {{{{( {1/2} )\lbrack {{Z_{1} - i} \in Y_{1}} \rbrack}\lbrack {{X_{2} + i} \in Y_{2}} \rbrack}X_{3}{Z_{4}( {H,I} )}},}} & ( {{H\quad \sigma_{x}},\sigma_{x}} ) \\{{{- {{( {1/2} )\lbrack {{Z_{1} - i} \in Y_{1}} \rbrack}\lbrack {{X_{2} - i} \in Y_{2}} \rbrack}}X_{3}{Z_{4}( {H,\sigma_{x}} )}},} & ( {{H\quad \sigma_{x}},I} )\end{matrix} $

[0150] These calculations lead to${\frac{1}{16}{\sum\limits_{L_{1},L_{2}}\quad {{Tr}\lbrack {{\$ ( {\Delta \quad l_{L_{1},L_{2}}^{QS}} )}\prod\limits_{L_{1},L_{2}}^{QS}}\quad \rbrack}}} = {{- \frac{1}{8}}Y_{1}{Y_{2}( {Z_{3} - X_{3}} )}( {Z_{4} - X_{4}} )}$

[0151] Finally, $\begin{matrix}\begin{matrix}{P_{B} = \quad {\frac{1}{2} + {\frac{1}{8}( {{X_{1}X_{3}} + {Z_{1}Z_{3}}} )( {{X_{2}X_{4}} + {Z_{2}Z_{4}}} )} -}} \\{\quad {\frac{1}{8}( {{\alpha\beta}^{*} + {\alpha^{*}\beta}} )Y_{1}{Y_{2}( {Z_{3} - X_{3}} )}( {Z_{4} - X_{4}} )}}\end{matrix} & (14)\end{matrix}$

[0152] The result indicates P_(B)≦¾ (which will be described in the nextitem [Maximum Value of P_(B) When |ψ>_(Q) Is A Product State]). If,therefore, |ψ>_(Q) is an n-qubit product state and Eve makesIntercept/Resend attack against each qubit of the systems Q and Sindependently, the probability that eavesdropping by Eve will not befound is suppressed to {fraction (3/4 )} per one qubit.

[0153] If the information to be transmitted is classical information, inparticular, |ψ>_(Q) becomes a product state of |0> and |1>, and each of2n qubits becomes {|0>,|1>} or {(1/{square root}{square root over(2)})(|0>+|1>)}. Letting a be an n-bit random key and |ψ>_(Q) be ann-bit cipher text, this technique becomes equivalent to BB84 and theone-time pad method. Letting m be the number of qubits on which Evetries to eavesdrop, the probability of success in eavesdropping is(¾)^(m) or less.

[0154] Consider next a case where |ψ>_(Q) is a general entangled n-qubitstate. The state encrypted by U_(i) ^(Q) is also an entangled state andgiven by equation (4). Consider first a case where Eve madeIntercept/Resend attack against a qubit of one of the systems Q and Sattack on either one in kth pair of qubits as shown in FIG. 6.Eavesdropping by Eve on m qubit pairs of the systems Q and S becomessubstantially equivalent to sending a classical statistical mixed stateof |ψ>_(Q) in which each qubit is a product state of |0> and |1>, as inequation (6). The probability that eavesdropping by Eve will not befound is therefore suppressed to (¾)^(m). Assume that Eve eavesdroppedon both qubits of m pairs of the systems Q and S, as shown in FIG. 8. Inthis case as well, the probability that eavesdropping by Eve will not befound is expressed by an equation similar to equation (11), and issuppressed to (¾)^(m) (which will be described in the item [MaximumValue of P_(B) When |ψ>_(Q) Is An Entangled State]).

[0155] In this case, no consideration is given to the safety ofencryption in a case where Eve makes eavesdropping based on entanglementby using a quantum computer. This case corresponds to the case where Evemakes an attack as shown in FIGS. 9A and 9B. Referring to FIGS. 9A and9B, if U₁, U₂, V₁, and V₂ are arbitrary unitary transformations, it isdifficult to obtain the upper limit of the probability of authenticationby Bob. If, for example, U₁=U₂=V₁=V₂=U where $U = \begin{pmatrix}{\cos ( {\pi/8} )} & {\sin ( {\pi/8} )} \\{\sin ( {\pi/8} )} & {- {\cos ( {\pi/8} )}}\end{pmatrix}$

[0156] and |ψ>_(Q) is classical information, i.e., |ψ>_(Q) is in ann-qubit product state of |0> and |1>, P_(B)=({fraction (13/16)})>(¾) inFIG. 9A, and P_(B)=({fraction (11/16)})<(¾) in FIG. 9B. Intercept/Resendattack with U is equivalent to observation/transmission of a qubit withthe basis given by${{{\phi_{i}\rangle}{\langle\phi_{i}}} = {\frac{1}{2}( {I + {( {- 1} )^{i}{X \cdot \sigma}}} )}},{X = ( {\frac{1}{\sqrt{2}},0,\frac{1}{\sqrt{2}}} )}$

[0157] Such a basis is called a Breidbart basis. Referring to FIG. 9A,although P_(B) exceeds ¾, the information obtained by Eve using thismethod is considered to be smaller in amount than the informationobtained by the Intercept/Resend attack against one qubit as shown inFIG. 6.

[0158] [Maximum Value of P_(B) When |ψ>_(Q) Is A Product State]

[0159] P_(B) of equation (14) does not exceed ¾ from the followingreason.

[0160] First of all, −1≦αβ*+α*β≦1 from |α|²+|β|²=1. Therefore, bychanging a sign like X_(i) →−X_(i) (i=1, . . . , 4), the upper limit ofP_(B) can be expressed as$P_{B} \leq {\frac{1}{2} + {\frac{1}{8}f_{MAX}}}$

[0161] where f_(MAX) is the maximum value of

f=(X ₁ X ₃ +Z ₁ Z ₃)(X ₂ X ₄ +Z ₂ Z ₄)+Y ₁ Y ₂(X ₃ +Z ₃)(X ₄ +Z ₄) |X_(i)|²=1, X _(i) , Y _(i) ,Z _(i)≧0 for i=1, . . . , 4  (15)

[0162] Equation (15) indicates the following. First of all, the maximumvalues of the first and second terms of f are 1 and 2, respectively. If,for example,

X ₁ =X ₂=(0,1,0), X ₃ =X ₄=(1/{square root}{square root over (2)},0,1 /{square root}{square root over (2)})  (16)

[0163] then, f=2. As is obvious, therefore, f_(MAX)≧2. In addition, evenif Y₃=Y₄=0, the value of f_(MAX) is not influenced.

[0164] Here, f≦2 (f_(MAX)=2) will be shown. For this purpose, it issufficient to indicate the absence of the stationary value of fexceeding 2 by using the Lagrange's method of undetermined multipliers.If${F( {\{ X_{i} \},\{ \lambda_{i} \}} )} = {f + {\sum\limits_{i = 1}^{4}\quad {\lambda_{i}( {1 - {X_{i}}^{2}} )}}}$

[0165] then,

∂F/∂X ₁ =X ₃(X ₂ X ₄ +Z ₂ Z ₄)−2λ₁ X ₁=0  (17)

∂F/∂Z ₁ =Z ₃(X ₂ X ₄ +Z ₂ Z ₄)−2λ₁ Z ₁=0  (18)

∂F/∂X ₃ =X ₁(X ₂ X ₄ +Z ₂ Z ₄)+Y ₁ Y ₂(X ₄ +Z ₄)−2λ₃ X ₃=0  (19)

∂F/∂Z ₃ =Z ₁(X ₂ X ₄ +Z ₂ Z ₄)+Y ₁ Y ₂(X ₄ +Z ₄)−2λ₃ Z ₃=0  (20)

∂F/∂Y ₁ =Y ₃(X ₃ +Z ₃)(X ₄ +Z ₄)−2λ₁ Y ₁=0  (21)

[0166] Similar equations can be obtained for ∂F/∂X₂=0, ∂F/∂Z₂=0,∂F/∂X₄=0, ∂F/∂Z₄=0, and ∂F/∂Y₂=0.

[0167] Consider equations (17) and (18). If X₂X₄+Z₂Z₄=0, then f≦2 isobtained from equation (15). Assume that X₂X₄+Z₂Z₄≢0. If λ₁=0, thenX₃=Z₃=0 and f=0. Hence, assume that λ₁≢0. Therefore,

X₃=kX₁, Z₃=kZ₁, k≢0  (22)

[0168] Substitutions of equations (22) into equations (19) and (20)yield

X ₁[(X ₂ X ₄ +Z ₂ Z ₄)−2λ₃ k]=Z ₁[(X ₂ X ₄ +Z ₂ Z ₄)−2λ₃ k]=−Y ₁ Y ₂(X ₄+Z ₄)

[0169] If (X₂X₄+Z₂Z₄)−2λ₃k=0, Y₁Y₂(X₄+Z₄)=0 and f≦1.By setting(X₂X₄+Z₂Z₄)−2λ₃k≢0, X₁=Z₁ and X₂=Z₃ are obtained. Similarly, X₂=2₂ andX₄=Z₄ are obtained. Since Y₃=Y₄=0,

X ₃ =X ₄=(1/{square root}{square root over (2)},0,1/{square root}{squareroot over (2)}  (23)

[0170] A substitution of equation (23) into equation (21) yieldsY₂=λ₁Y₁. Likewise, from ∂F/∂Y₂=0, Y₁=λ₂Y₂ is obtained. Therefore,Y₂=λ₁λ₂Y₂. If Y₂=0, then f≦1. From this reason, by setting Y₂≢=0, λ₁λ₂=1is obtained. A substitution of equation (23) into equation (17) yieldsX₂=2λ₁X₁. Likewise, from ∂F/∂X₂=0, X₁=2λ₂X₂ is obtained. Therefore,X₂=4λ₁λ₂X₂, and X₂=X₁=0 is obtained. The result contracts equations (22)and (23).

[0171] According to the above description, it is apparent that nostationary value of f exceeds 2, and the maximum value of f isf_(MAX)=2.

[0172] [Maximum Value of P_(B) When |ψ>_(Q) Is An Entangled State]

[0173] The probability that eavesdropping by Eve will not be found when|ψ>_(Q) is a general n-qubit entangled state and Eve makesIntercept/Resend attack against m qubit pairs of the systems Q and Swill be evaluated.

[0174] For the sake of simplicity, consider first a case where |ψ>_(Q)is an entangled state of a 2-qubit system qq′.${\Psi\rangle}_{Q} = {{\sum\limits_{i,{j \in {\{{0,1}\}}}}\quad {c_{ij}{{i\rangle}_{q} \otimes {j\rangle}_{q^{\prime}}}}} \in {\forall H_{2}^{2}}}$

[0175] Alice adds two signature qubit systems S(=ss′) to the respectivequbit systems Q(=qq′). As shown in FIG. 6, the systems Q and S areentangled by C-NOT, and L₁, L₂, L₁ ^(′), L₂ ^(′)ε{L} are applied to fourqubits q, s, q′, and s′, transmitting the resultant information to Bob.As shown in FIG. 8, Eve tries to make Intercept/Resend attack againstthe systems q, s, q′, and s′. Even if the initial values of qubits s ands′ as signatures are set to |0>_(S) and |0>_(S′), no generality is lost.

[0176] The state transmitted from Alice is given by${{\sum\limits_{i,{j \in {\{{0,1}\}}}}{\quad c_{ij}L_{1}{{i}\rangle}_{q}L_{2}{i\rangle}_{s}}} \otimes L_{1}^{\prime}}{{j}\rangle}_{q^{\prime}}L_{2}^{\prime}{{j}\rangle}_{s^{\prime}}$

[0177] This is explicitly written in density operator as follows:$\begin{matrix}\begin{matrix}{\rho_{L_{1}L_{2}L_{1}^{\prime}L_{2}^{\prime}}^{QS} = \quad {( {L_{1}L_{2}L_{1}^{\prime}L_{2}^{\prime}} ){\sum\limits_{i,{j \in {\{{0,1}\}}}}\lbrack {{c_{ij}}^{2}( {{i\rangle}{{\langle i}_{q} \otimes {i\rangle}}{\langle i}_{s}{) \otimes}} } }}} \\{\quad ( { {j\rangle}{{\langle j}_{q^{\prime}} \otimes {j\rangle}}{\langle j}_{s^{\prime}} ) +} } \\{\quad {c_{ij}{{c_{i\overset{\_}{j}}^{*}( {{i\rangle}{{\langle i}_{q} \otimes {i\rangle}} \langle{i} )_{s}} )} \otimes ( { {j\rangle}{{\langle\overset{\_}{j}}_{q^{\prime}} \otimes {j\rangle}}{\langle\overset{\_}{j}}_{s^{\prime}} ) +} }}} \\{\quad {{c_{ij}{{c_{\overset{\_}{i}j}^{*}( {{i\rangle}{{\langle\overset{\_}{i}}_{q} \otimes {i\rangle}}{\langle\overset{\_}{i}}_{s}} )} \otimes ( {{j\rangle}{{\langle j}_{q^{\prime}} \otimes ( {{j\rangle}{\langle j}_{s^{\prime}}} )}} )}} +}} \\{\quad {c_{ij}{{c_{\overset{\_}{i}\overset{\_}{j}}^{*}( {{i\rangle}{\langle\overset{\_}{i}}_{q}{i\rangle} \langle{\overset{\_}{i}} )_{s}} )} \otimes ( { {j\rangle}{\langle\overset{\_}{j}}_{q^{\prime}}{j\rangle}{\langle\overset{\_}{j}}_{s^{\prime}} )\rbrack} }}} \\{\quad ( {L_{1}L_{2}L_{1}^{\prime}L_{2}^{\prime}} )^{\dagger}}\end{matrix} & (24)\end{matrix}$

[0178] where ĩ=i+1 (mode 2).

[0179] If Eve eavesdrops on the state ρ_(L) ₁ ^(Q) _(L) ₁ ^(S) _(L′) ₁_(L′) ₂ sent from Alice, it is transformed into${\$ ( \rho_{L_{1_{1}}L_{2_{1}}L_{1}^{\prime}L_{2}^{\prime}}^{QS} )} = {\sum\limits_{i,j,k,{l \in {\{{0,1}\}}}}{{{Tr}( {\rho_{L_{1}L_{2}L_{1}^{\prime}L_{2}^{\prime}}^{QS}{\overset{\sim}{\rho}}_{q,i}^{\prime}{\overset{\sim}{\rho}}_{s,j}^{\prime}{\overset{\sim}{\rho}}_{q^{\prime},k}^{\prime}{\overset{\sim}{\rho}}_{s^{\prime},l}^{\prime}} )}{\overset{\sim}{\rho}}_{q,i}^{\prime}{\overset{\sim}{\rho}}_{s,j}^{\prime}{\overset{\sim}{\rho}}_{q^{\prime},k}^{\prime}{\overset{\sim}{\rho}}_{s^{\prime},l}^{\prime}}}$

[0180] where${{\overset{\sim}{\rho}}_{q,i} = {( {1/2} )\quad\lbrack {I + {( {- 1} )^{i}{X_{1} \cdot \sigma}}} \rbrack}},{{\overset{\sim}{\rho}}_{s,j} = {( {1/2} )\lbrack {I + {( {- 1} )^{i}{X_{2} \cdot \sigma}}} \rbrack}}$${{\overset{\sim}{\rho}}_{q,i}^{\prime} = {( {1/2} )\quad\lbrack {I + {( {- 1} )^{i}{X_{3} \cdot \sigma}}} \rbrack}},{{\overset{\sim}{\rho}}_{s,j}^{\prime} = {( {1/2} )\lbrack {I + {( {- 1} )^{j}{X_{4} \cdot \sigma}}} \rbrack}}$${{\overset{\sim}{\rho}}_{q^{\prime},i} = {( {1/2} )\quad\lbrack {I + {( {- 1} )^{k}{X_{1}^{\prime} \cdot \sigma}}} \rbrack}},{{\overset{\sim}{\rho}}_{s^{\prime},l} = {( {1/2} )\lbrack {I + {( {- 1} )^{l}{X_{2}^{\prime} \cdot \sigma}}} \rbrack}}$${{\overset{\sim}{\rho}}_{q^{\prime},k} = {( {1/2} )\quad\lbrack {I + {( {- 1} )^{k}{X_{3}^{\prime} \cdot \sigma}}} \rbrack}},{{\overset{\sim}{\rho}}_{s^{\prime},l} = {( {1/2} )\lbrack {I + {( {- 1} )^{l}{X_{4}^{\prime} \cdot \sigma}}} \rbrack}}$

[0181] and, |X_(k)|²=|X_(k) ^(′)|²=1 (k=1, . . . , 4). Bob performsobservation with the following operator: $\begin{matrix}{\prod\limits_{L_{1}L_{2}L_{1}^{\prime}L_{2}^{\prime}}^{QS}\quad {= \quad {{{{{{{{{{{{{( {L_{1}L_{2}} )( {0} }\rangle}{\langle 0}}}_{q} \otimes {0}}\rangle}{\langle 0}}}_{s} + {1}}\rangle}{\langle 1}}}_{q} \otimes}}} \\{{{{{{\quad  {{{{1}\rangle}{\langle 1}}}_{s} )}{( {L_{1}L_{2}} )^{\dagger} \otimes ( {L_{1}^{\prime}L_{2}^{\prime}} )}( {0} }\rangle}{\langle 0}}}_{q^{\prime}} \otimes} \\{{\quad  {{{{{{{{{{{{0}\rangle}{\langle 0}}}_{s^{\prime}} + {1}}\rangle}{\langle 1}}}_{q^{\prime}} \otimes {1}}\rangle}{\langle 1}}}_{s^{\prime}} )}( {L_{1}^{\prime}L_{2}^{\prime}} )^{\dagger}}\end{matrix}$

[0182] The probability that Bob will observe the authentic signature isgiven by $\begin{matrix}{P_{B} = \quad {( {\frac{1}{16}\sum\limits_{L_{1},{L_{1} \in L}}}\quad )( {\frac{1}{16}\sum\limits_{L_{1}^{\prime},{L_{2}^{\prime} \in L}}}\quad ){{Tr}\lbrack {{\$ ( \rho_{L_{1}L_{2}L_{1}^{\prime}L_{2}^{\prime}}^{QS} )}\prod\limits_{L_{1}L_{2}L_{1}^{\prime}L_{2}^{\prime}}^{QS}} \rbrack}}} \\{= \quad \lbrack {\frac{1}{2} + {\frac{1}{8}( {{X_{1}X_{3}} + {Z_{1}Z_{3}}} )( {{X_{2}X_{4}} + {Z_{2}Z_{4}}} ){\rbrack\quad\lbrack {\frac{1}{2} + {\frac{1}{8}( {{X_{1}^{\prime}X_{3}^{\prime}} + {Z_{1}^{\prime}Z_{3}^{\prime}}} )}} }}} } \\{{\quad  ( {{X_{2}^{\prime}X_{4}^{\prime}} + {Z_{2}^{\prime}Z_{4}^{\prime}}} ) \rbrack} + {\sum\limits_{i,{j \in {\{{0,1}\}}}}\{ {c_{ij}{c_{i\overset{\_}{j}}^{*}\quad\lbrack {\frac{1}{2} + {\frac{1}{8}( {{X_{1}X_{3}} + {Z_{1}Z_{3}}} )}} }} }} \\{{{\quad  ( {{X_{2}X_{4}} + {Z_{2}Z_{4}}} ) \rbrack}\lbrack {{- \frac{1}{8}}Y_{1}^{\prime}{Y_{2}^{\prime}( {Z_{3}^{\prime} - X_{3}^{\prime}} )}( {Z_{4}^{\prime} - X_{4}^{\prime}} )} \rbrack} +} \\{\quad {c_{ij}{{c_{\overset{\_}{i}j}^{*}\lbrack {{- \frac{1}{8}}Y_{1}{Y_{2}( {Z_{3} - X_{3}} )}( {Z_{4} - X_{4}} )} \rbrack}\lbrack {\frac{1}{2} + {\frac{1}{8}( {{X_{1}^{\prime}X_{3}^{\prime}} + {Z_{1}^{\prime}Z_{3}^{\prime}}} )}} }}} \\{{\quad  ( {{X_{2}^{\prime}X_{4}^{\prime}} + {Z_{2}^{\prime}Z_{4}^{\prime}}} ) \rbrack} + \quad {c_{ij}{c_{\overset{\_}{i}\overset{\_}{j}}^{*}\lbrack {{- \frac{1}{8}}Y_{1}{Y_{2}( {Z_{3} - X_{3}} )}( {Z_{4} - X_{4}} )} \rbrack}}} \\{\quad  \lbrack {{- \frac{1}{8}}Y_{1}^{\prime}{Y_{2}^{\prime}( {Z_{3}^{\prime} - X_{3}^{\prime}} )}( {Z_{4}^{\prime} - X_{4}^{\prime}} )} \rbrack \}}\end{matrix}$

[0183] From Σ_(i,jε{0,1})|c_(ij)|²=1, Σ_(i,jε{0,1})c_(ij)c₋ _(ij)^(*)|≦1, Σ_(i,jε{0,1})c_(ij)c₋ _(ij) ^(*)|≦1, and Σ_(i,jε{0,1})c_(ij)c₋₋_(ij) ^(*)|≦1 is obtained. Therefore, according to the discussion of[Maximum Value of P_(B) When |ψ>_(Q) Is An Product State],${P_{B} \leq ( {\frac{1}{2} + {\frac{1}{8}f_{MAX}}} )^{2}} = ( \frac{3}{4} )^{2}$

[0184] Obviously, when Eve eavesdrops on m qubits with respect to|ψ>_(Q) in the general n-qubit state, the probability can be suppressedto${P_{B} \leq ( {\frac{1}{2} + {\frac{1}{8}f_{MAX}}} )^{m}} = ( \frac{3}{4} )^{m}$

Second Embodiment

[0185] A quantum state encryption method and apparatus will be describedbelow, which have the following characteristic feature. A qubitrepresenting the signature of a sender is added to each of qubitsconstituting an n-qubit quantum state subjected to first encryption inorder to guarantee that a quantum state is really transferred from thesender to the recipient. In the second encryption method, the identityoperator or Hadamard transformation H applied to one qubit is randomlyapplied to each added qubit representing the signature, and n qubitsrepresenting quantum information and the qubits representing thesignature are randomly permutated to prevent an eavesdropper fromcounterfeiting the qubits representing the signature. The recipientobserves each qubit representing the signature by decrypting thereceived state, thereby performing both authentication and detection ofthe intervention of the eavesdropper.

[0186] In addition, a quantum state encryption method and apparatus willbe described below, which have the following characteristic feature. Todetect that an eavesdropper has observed and destroyed part of quantuminformation to be transmitted, L partial sets of arbitrary qubits areselected from n qubits representing the quantum state to be encrypted,and one auxiliary qubit is added to each partial set so as to make thesum (parity) of the values of qubits included in each partial set becomeeven. These (n+L) qubits are randomly permutated first, and then thefirst encryption, addition of signature qubits, and second encryptionare performed.

[0187]FIG. 16 is a view showing procedures in a quantum state encryptionmethod according to the second embodiment. Reference numeral 161 denotesan encryption procedure on the transmitting side (Alice); and 162, adecryption procedure on the receiving side (Bob). Referring to FIG. 16,as in FIG. 15, each thick arrow represents the transfer of a quantumstate (quantum information), and each thin arrow represents the transferof classical information.

[0188] The encryption procedure 161 on the transmitting side (Alice)will be described first. In the encryption procedure 161, the firstencryption processing 1611 (U_(i) ^(Q)) is performed for an n-qubitquantum state (|ψ>_(Q)) to be transmitted by using a 2n-bit randomstring i to transform it into U_(i) ^(Q)|ψ>_(Q). In signature generation1612, an m-qubit state (|0>_(S)) initialized as a groud state istransformed into a quantum system (|b>_(S)) representing a signature byusing an m-bit random string b.

[0189] As in FIG. 15, each symbol indicated by the circle in FIG. 15represents a procedure for generating a random string constituted byclassical bits, which can be obtained by using a random number generatedby a general, classical computer or a random number table preparedindividually on the sending side (Alice) in advance.

[0190] The sending side (Alice) couples these two quantum systems U_(i)^(Q)|ψ>_(Q) and |b>_(S) (couples them as tensor product states; thisoperation is equivalent to simply placing n qubits having the originalquantum information and m qubits representing the signature side byside). The second encryption processing 1613 (P_(β) ^(QS)) is performedfor this coupling result (|b>_(S) {circle over (×)} U_(i) ^(Q)|ψ>_(Q))by using a log[(m+n)!]-bit random string β. The sending side (Alice)transmits the (n+m)-qubit state (P_(α) ^(QS)[|b>_(S) {circle over (×)}U_(i) ^(Q)|ψ>_(Q)]), obtained by these operations to the receiving side(Bob) through a quantum channel.

[0191] The decryption procedure 162 on the receiving side (Bob) will bedescribed next. The receiving side (Bob) performs measurement (a kind ofmeasurement of the number of qubits, which is performed by the qubitcounter in FIG. 16) 1621 with respect to the (n+m)-qubit state (P_(β)^(QS)[|b>_(S) {circle over (×)} U_(i) ^(Q)|ψ>_(Q)]) sent from thesending side (Alice) to confirm the arrival of qubits, and notifies thesending side (Alice) that the expected 2n qubits were really received.The receiving side then performs the first decryption (inversetransformation (P_(β) ^(QS))⁻¹) for the second encryption) 1622 by usingthe second log[(m+n)!]-bit password β received from the sending side(Alice). After the decryption, (n+m)-qubit (|b>_(S) {circle over (×)}U_(i) ^(Q)|ψ>_(Q)) is separated into the n-qubit state (U_(i)^(Q)|ψ>_(Q)) having the original quantum information and the m-qubitstate (|b>_(S)) representing the signature. The receiving side (Bob)performs observation 1623 of the signature qubit (|b>_(S)), and notifiesthe sending side (Alice) of the result. Finally, the receiving sideobtains the original n-qubit quantum information (51 ψ>_(Q)) byperforming the second decryption (inverse transformation (U_(i) ^(Q))⁻¹for the first encryption) 1624 by using the first 2n-bit password i.

[0192] The first and second encryption procedures and the procedures forexchanging information through classical and quantum channels follow, inpractice, the following description of the second embodiment and theabove description in [Encryption of Quantum State] and [QuantumEncryption Protocol].

[0193] A signature is placed in the following manner. First of all, anm-bit random string a=(a₁, . . . , a_(m)) ε {0,1}^(m) is prepared toform a quantum state |a>_(S)=|a₁>_(S){circle over (×)}···{circle over(×)}|a_(m)>_(S) representing an m-qubit signature. One of operators{I,H} is randomly applied to each of m qubits with a probability of ½.The signature obtained in this manner, which represents the m-qubitquantum state, is written |b>_(S)=|b₁>_(S){circle over (×)}···{circleover (×)}|b_(m)>_(S).

[0194] The state obtained by adding the signature |b>_(S) to the quantumdata U_(i) ^(Q)|ψ>_(Q) having undergone the first encryption is written${{{{{b}\rangle}_{s} \otimes U_{i}^{Q}}{\Psi}}\rangle}_{Q} = {\sum\limits_{x \in {\{{0,1}\}}}\quad {c_{x}{\underset{\underset{{system}\quad S}{}}{{{{b_{1}}\rangle} \otimes \quad \ldots \quad \otimes {b_{m}}}\rangle} \otimes \underset{\underset{{system}\quad Q}{}}{{{{x_{1}}\rangle} \otimes \quad \ldots \quad \otimes {x_{x}}}\rangle}}}}$

[0195] In addition, (m+n) qubits are permutated. An operator for thepermutation of qubits is defined as follows. The permutation of (m+n)sequences as β is given by $\beta = \begin{pmatrix}1 & 2 & \cdots & {m + n} \\\beta_{1} & \beta_{2} & \cdots & \beta_{m + n}\end{pmatrix}$

[0196] where, {β₁, . . . , β_(m+n)}={1, . . . , m+n}. There are (m+n)!permutations β, and hence log[(m+n)!]-bit information is required todesignate β.

[0197] Consider transformation P_(β) ^(QS) for permutation of each qubitvalue of (m+n)-qubit information according to β. If, for example, eachof |b>_(S) and U_(i) ^(Q)|ψ>_(Q) is 1-qubit information, and βrepresents permutation of these qubit values, then${{{{P_{\beta}^{QS}{\sum\limits_{x \in {\{{0,1}\}}}\quad {c_{x}{b}}}}\rangle} \otimes {x}}\rangle} = {{\sum\limits_{x \in {\{{0,1}\}}}\quad {c_{x}{{{{x}\rangle} \otimes {b}}\rangle}{\quad \quad}{for}\quad \beta}} = \begin{pmatrix}1 & 2 \\2 & 1\end{pmatrix}}$

[0198] Such transformation is unitary, and expressed in 4×4 matrix asfollows in practice:$\underset{{{{\langle 00}{\langle 01}}}{\langle 10}{\langle 11}}{\begin{pmatrix}1 & 0 & 0 & 0 \\0 & 0 & 1 & 0 \\0 & 1 & 0 & 0 \\0 & 0 & 0 & 1\end{pmatrix}}\begin{matrix}{{00}\rangle} \\{{01}\rangle} \\{{10}\rangle} \\{{11}\rangle}\end{matrix}$

[0199] In addition, this transformation can be implemented by thequantum gate network in FIG. 10. The probability that Eve will properlyextract a qubit corresponding to the signature portion is n!/(m+n)!.Permutation of qubit values seems to use entanglement between the qubitsfrom the viewpoint of the quantum gate network in FIG. 10. However,there is no effect of entanglement as for P_(β) ^(QS) as a whole.

[0200] The transformation V_(α) ^(QS) in the second encryption describedin associated with equation (5) corresponds to application of I or H toeach qubit representing the signature and the permutation operationP_(β) ^(QS). Therefore, a password for decryption for the secondencryption is (m+log[(m+n)!])-bit.

[0201] Consider strategies taken by an eavesdropper and safety ofencryption. Two strategies that can be taken by Eve will be described indetail below. The first strategy is a method in which Eve observes allqubits that are transmitted with the same basis and sends substitutequbits in accordance with the observation results (Intercept/Resendattack). The second strategy is a method in which Eve extracts some ofqubits that are transmitted and sends substitute qubits in a properstate.

[0202] Consider the following prior to a description of the firststrategy, in which Eve makes Intercept/Resend attack against all qubitswith the same basis. In forming |b>_(S) as a signature qubit, Alicerandomly activated Hadamard transformation H to use two types of bases{|0>,|1>} and {(1/{square root}{square root over (2)})(|0>+|1>)}. Thisaims at preventing the following Eve's fraud. Assume that |b>_(S) iscoded by using only {|0>,|1>}. In this case, Eve may prepare (m+n)-qubit|0>_(E){circle over (×)}···{circle over (×)}|0>_(E), copy each qubitvalue by applying a C-NOT gate to each qubit in an encrypted state, andthen send the original state to Bob. In this case, m signature qubitsare subjected to the following transformation:

|b _(i)> {circle over (×)} |0>_(E) C - NOT|b _(i)>_(E) , b _(i) ε {0,1}for i=1, . . . , m

[0203] Since the signature portion |b>_(S) is not entangled with thequbits held by Eve, the signature of Bob is properly observed. Ingeneral, however, the quantum data portion is entangled with the qubitsheld by Eve, and hence the data is destroyed, and the information ispartly taken away.

[0204] If |b>_(S) is formed by two types of bases, such danger can beavoided. If, for example, (1/{square root}{square root over(2)})(|0>+|1>) is signed as |b_(i)> and Eve writes it in her own qubitby using the C-NOT gate, then $\begin{matrix} {{{{\underset{\underset{E}{}}{{\frac{1}{\sqrt{2}}\underset{\underset{S}{}}{ {{{( {0} \rangle} + {1}}\rangle} )}{0}}\rangle}\quad \underset{}{C - {NOT}}\quad \frac{1}{\sqrt{2}}( {00} }\rangle} + {11}}\rangle} ) & (26) \\{=  {{{{ {{{{ {{{{ {{{{\frac{1}{2\sqrt{2}}( {0} }\rangle} + {1}}\rangle} )( {0} }\rangle} + {1}}\rangle} ) + {\frac{1}{2\sqrt{2}}( {0} }}\rangle} - {1}}\rangle} )( {0} }\rangle} - {1}}\rangle} )} & (27)\end{matrix}$

[0205] Alice and Bob therefore notice that the signature is notauthentic with a probability of ½. This technique is essentiallyequivalent to the eavesdropper detection method in BB84.

[0206] The above operation will be described further in detail. Evecannot discriminate which qubits of the (n+m) qubits have quantuminformation and which qubits represent the signature. Assume that Evemakes Intercept/Resend attack against all the qubits with the samebasis. This operation is equivalent to applying the quantum gate networkshown in FIG. 7 to all the qubits. As obtained according to equation(9), the probability that Alice and Bob will overlook the interventionof Eve using the network in FIG. 7 does not exceed ¾. This means that ifthe number of signature qubits is represented by m, the probability thatAlice and Bob will overlook the presence of Eve is as low as (¾)^(m).

[0207] Consider next the second eavesdropping strategy, in which Eveextracts some qubits and sends substitute qubits to Bob. Consider a casewhere Eve arbitrarily extracts some qubits from the (n+m) qubits andsends substitute qubits to Bob. In this case, if the qubits extracted byEve represent the signature, since this operation corresponds to thefirst eavesdropping strategy taken by Eve, which is described above,eavesdropping can be easily detected. A problem arises when all thequbits extracted by Eve represent quantum information. In this case,since the signature qubits are remain intact, Alice and Bob properlyauthenticate the qubits without noticing eavesdropping. Therefore, thefollowing technique may be used. First of all, the number of signaturequbits is set to n, which is equal to that of the information portion,thus forming 2n qubits as a whole. In this case, the probability thatEve will extract l qubits of the quantum information portion alone isgiven by${{\frac{N}{2N} \cdot \frac{N - 1}{{2N} - 1}}\quad \ldots \quad \frac{N - ( {l - 1} )}{{2N} - ( {l - 1} )}} \leq ( \frac{1}{2} )^{l}$

[0208] This probability is on the same order as that of the expectedvalue obtained when l arbitrary qubits (|Φ>) and l qubits (|ψ>)representing quantum information are prepared, and a fidelity F=|>Φ|ψ>|²is calculated. This indicates that even if such eavesdropping isperformed, the expected value of information amount obtained by Eve isvery small.

[0209] In this state, however, Alice and Bob do not notice that Eve hasdestroyed the quantum information partly. For this reason, the followingtechnique is used. A partial set of arbitrary qubits is selected fromthe n-qubit information representing the quantum information |ψ>_(Q) tobe transmitted, and auxiliary qubits are added to the partial set tomake the sum (parity) of all qubit values become even. If the number ofqubits constituting the partial set is represented by k (1≦k≦n), thequantum gate network shown in FIG. 11 may be used to make the parity of(k+1)-qubit information become even as a whole.

[0210] L such partial sets are selected, and L auxiliary qubits areadded. Permutation is then randomly performed with respect to(n+L)-qubit information. Finally, the resultant data is encrypted byM_(n+L) of equation (2). Decrypting this data, Bob performs inversetransformation to the quantum gate network in FIG. 11 to observe the Lauxiliary qubits. If the data is properly transmitted, Bob shouldobserve |0> in all the auxiliary qubits.

[0211] If, for example, one of the (n+L) qubits is replaced, about L/2sets have contradiction for parity. Since Alice, Bob, and Eve do notknow the specific states of the (n+L) qubits, the probability that acontradiction will arise in one parity relationship can be regarded tobe ½ on average with respect to all of the possible |ψ>_(Q). Therefore,both the probabilities that Bob will obtain |0> and |1> by observing theauxiliary qubits is ½. The probability that Bob will overlook thedestruction of quantum information by Eve is (½)^(L/2) on average withrespect to all of the possible |ψ>_(Q).

Third Embodiment

[0212] In this embodiment, a quantum state encryption method andapparatus will be described below, which are characterized in thatphoton-counting measurement is performed, as measurement performed to arecipient to examine whether each qubit is really received on the sideof the recipient, by using the nonlinear effect produced by introducingtwo photons into a cavity in which nuclei are injected.

[0213] Consider a case where 1-qubit information is expressed by twophoton paths (modes x and y). States in which a photon exists and doesnot exist in each mode are represented by |0> and |1>, respectively. Forexample, a state in which one photon exists in mode x and no photonexists in mode y is represented by |1>_(x){circle over (×)}|0>_(y)=|10>.In addition, |01> and |10> are regarded as 1-qubit logic expressions|{tilde over (0)}> and |{tilde over (1)}>, respectively. An arbitrary1-qubit state is given by

|Ψ>=α|01>+β|10>=α|{tilde over (0)}>+β|{tilde over (1)}> for |α|²+|β|²=1

[0214] Such a method of forming qubits is called dual-railrepresentation (I. L. Chuang and Y. Yamamoto, “Simple quantum computer”,Phys. Rev. A 52, 3489 (1995)).

[0215] Assume that the eavesdropper Eve installed a 50-50 beam splittermidway along a quantum channel and tried to steal a photon. In thiscase, the photon is in superposition of states where the photon on theside of Bob and the photon on the side of Eve with amplitude of1/{square root}{square root over (2)}:$\frac{1}{\sqrt{2}}\quad {{\text{photon on the side of Bob〉}\quad + \frac{1}{\sqrt{2}}}\quad \text{photon on}}$the side of Eve〉

[0216] To examine whether a qubit representing |Ψ> is on hand, Bobprepares another photon as an auxiliary system, and causes a nonlinearinteraction between this photon and the photon passing through two pathsrepresenting the qubit. In the optical system shown in FIG. 12C, if aphoton exists on the side of Bob, an observation device D_(a) detectsthe photon of the auxiliary system. If no photon exists on the side ofBob, an observation device D_(b) detects the photon of the auxiliarysystem. If the observation device D_(a) reacts, the photon is projectedto the state where it exists on the side of Bob. If the observationdevice D_(b) reacts, the photon shrinks to the state where it exists onthe side of Eve.

[0217] The optical system shown in FIG. 12C uses a beam splitter B forperforming SU(2) transformation for the logical expression {|{tilde over(0)}>,|{tilde over (1)}>} and an device K for causing Kerr-typeinteraction between incident photons in FIG. 12B. The device K causes πrotation of the phase of a wave function only when two photons areincident.

[0218] Q. A. Turchette et al. achieved success in an experiment inrotating a phase Δ by 16° by injecting an atom into a cavity surroundedby reflecting mirrors and causing an interaction between the atom andtwo externally incident photons (Q. A. Turchette, C. J. Hood, W. Lange,H. Mabuchi, and J. Kimble, “Measurement of conditional phase shifts forquantum logic”, Phys. Rev. Lett. 75, 4710 (1995)). They noted that theabsorption transition of circularly polarized light σ_ at a given levelof a Cs atom is greatly suppressed as compared with σ₊absorptiontransition (coupling constant: g_=g₊/{square root}{square root over(45)}), and used the phenomenon in which transition is saturated whentwo σ₊ photons enter a cavity:

|1⁺>_(x)|1⁺>_(a) → e^(iΔ)|1⁺>_(x)|1⁺>_(a)

[0219] thus inhibiting phase rotation in other cases.

[0220] If Bob performs measurement to check the presence/absence ofphotons like those shown in FIGS. 12A to 12C with respect to eachchannel through which a photon is transferred to the side of Bob, he cancheck whether all photons have arrived.

Fourth Embodiment

[0221] In this embodiment, an input means, storage means, computationmeans, and output means for arbitrary quantum information will bedescribed. In the information processing using qubits in the first andsecond embodiments as well, these input means, storage means,computation means, and output means for information are commonly used.

[0222] This embodiment exemplifies the quantum state encryption methoddefined in claim 21 and the quantum state encryption apparatus definedin claim 22. More specifically, a quantum state encryption method andapparatus characterized in that polarization of photons, the spins ofelectrons, nucleons, and the like (including the spins of electrons andnucleons in solids and the spins of nuclei in polymer compounds), andthe basis states and excited states of ions are used as qubits will bedescribed.

[0223] A qubit used in the first and second embodiments exhibits noessential difference between any physical systems as long as it is aquantum system realizing the Hilbert space based on two orthogonalstates as a basis. Qubit candidates include the spins of electrons,nucleons and the like (including the spins of electrons and nuclei insolids and the spins of nuclei in polymer compounds), and the groundstates and excited states of ions.

[0224] Consider, for example, the spin of a nucleon. The Hamiltonian oftwo nuclear spins in a homogenous static field B is given as follows:$\begin{matrix}{H = {E_{0} - {\frac{\hslash}{2}{( {{\gamma_{A}\sigma_{A}} + {\gamma_{B}\sigma_{B}}} ) \cdot B}} + {k_{AB}{\sigma_{A} \cdot \sigma_{B}}}}} & (28)\end{matrix}$

[0225] The second and third terms of equation (28) respectivelyrepresent a Zeeman term and a spin-spin interaction term. Assume thatthe magnetic field is orientated to the z-axis (B=(0,0,B₀)), and thespin-spin interaction is sufficiently smaller than due to an energylevel shift caused by the Zeeman effect (|k_(AB)|<<|(/2)γ_(A)B₀|≅| (/2)γ_(B)B₀|). Owing to a strong magnetic field in the z direction, as thetwo spins are aligned in the z direction, the energy is suppressed low.As a consequence, the third term can be approximated to the scalarinteraction between z components. The Hamiltonian is given by$H \cong {E_{0} - {\frac{\hslash}{2}\omega_{A}\sigma_{z}^{A}} - {\frac{\hslash}{2}\omega_{B}\sigma_{z}^{B}} + {\frac{\hslash}{2}\omega_{AB}\sigma_{z}^{AB}}}$

[0226] where ω_(A)=γ_(A)B₀,ω_(B)=γ_(B)B₀, and (½)ω_(AB)=k_(AB). Assumethat ω_(A) and ω_(B) slightly differ from each other, and the differenceis given by Δε=|ω_(A)−ω_(B)|. Energy level shifts are summarized in FIG.13.

[0227] If the downward and upward directions are represented by |1> and|0>, respectively, when spins are diagonalized in the z direction, anuclear spin system can be regarded as a qubit system. If, therefore, aplurality of nuclear spins are prepared, a plurality of qubits areprepared. If |0

0> is to be input as an initial state to these qubits, a homogeneousstatic field B=(0,0,B), which is sufficiently strong in the z-axisdirection, may be applied to all the nuclear spins. With this operation,all the nuclear spins are aligned in the direction of magnetic field. Inthis case, therefore, control based on the interaction (Zeeman effect)between an external magnetic field and nuclear spins serves an inputmeans for information.

[0228] Once the quantum state of a nuclear spin is confirmed, the stateis held at least within the decoherence time. This phenomenon may beregarded as a storage means for information. The above effects describedso far in the above embodiments can be applied to the transmission of anuclear spin as long as a transmission time is within the decoherencetime.

[0229] The computation means will be described below. All computationsfor qubit systems are unitary transformations in the Hilbert space inwhich the qubit systems are formed. An arbitrary unitary transformationfor a plurality of qubits can be implemented by combining an arbitraryunitary transformation for one qubit and a C-NOT gate between twoqubits. These unitary transformations can be executed by beaming anelectromagnetic wave (laser pulse) having a frequency corresponding toan energy slightly shifted from the energy level difference between thestates shown in FIG. 13. The nuclear spins to which the electromagneticwave is beamed cause Bloch vibrations between the levels having theenergy difference corresponding to the frequency. A transition to atarget state can be freely caused by adjusting the intensity andradiation time of a laser pulse. If, for example, an electromagneticwave having a frequency of (ω_(A)+ω_(B)) +Δε is beamed, unitary rotationcan be executed between | ↓ ↓ > and | ↓ ↑ >. By properly combiningresonance pulses, “C-NOT” can also be executed. Therefore, the Blochvibrations caused by the interaction between an external magnetic fieldand nuclear spins (Zeeman effect) and Block vibration which comes froman energy level shift due to a spin-spin interaction serve as acomputation means for information.

[0230] To obtain an output from a qubit is to observe the z-axisdirection of a nuclear spin. Various methods of observing this have beenproposed. The most simple method is a method using a so-calledStern-Gerlach apparatus, often referred to in the introduction ofquantum mechanics, which is designed to let a nuclear spin as a beampass through an inhomogeneous magnetic field (“The Feynman Lectures onPhysics, vol. 3”, R. P. Feynman, R. B. Leighton, and M. Sands,Addison-Wesley Publishing Company (1965)). Assume that a magnetic fieldand its gradient are orientated in the z direction, and a nucleon beamis incident in a direction perpendicular to the magnetic field. Thenucleon beam is split due to the z-direction component of the spin, andthe z-axis direction of the nuclear spin can be observed by detectingthis fission. A method of observing electron spins instead of nuclearspins has been proposed (B. E. Kane, “A silicon-based nuclear spinquantum computer”, Nature, 393, p. 133-137 (1998)). These techniques cantherefore be regarded as output means for information.

[0231] The above description is made by taking a nuclear spin as anexample. Even if, however, other physical systems are used as qubits, aninput means, storage means, computation means, and output means forinformation can be prepared, and ideas based on physics which are usedin such cases have many commonalties with the above description.

[0232] In a reference (J. I. Cirac and P. Zoller, “Quantum Computationswith Cold Trapped Ions”, Phys. Rev. Lett. 74, 4091 (1995)), a method ofexecuting a C-NOT gate by using a method called Cold Trapped Ions isdiscussed. In this case, n ions are linearly trapped, and the groundstate and the first excited state of each ion are regarded as {|0>,|1>}of a qubit. The quantum gate is operated by externally applying a laserbeam to each ion.

[0233] The linearly trapped ions cause Coulomb interaction, and each ionvibrates around a position of equilibrium. This vibration mode isquantized into a phonon to be used as an auxiliary qubit. In the abovereference, a method of executing a C-NOT gate by effectively using thisphonon is proposed.

[0234] As has been described above, according to the present invention,there are provided a method and apparatus for encrypting an arbitraryquantum state and transmitting it without letting a sender and recipientshare an entangled pair of qubits in advance.

[0235] As many apparently widely different embodiments of the presentinvention can be made without departing from the spirit and scopethereof, it is to be understood that the invention is not limited to thespecific embodiments thereof except as defined in the claims.

What is claimed is:
 1. An encryption method comprising: the acquisitionstep of inputting arbitrary quantum information and acquiringinformation of a quantum two-state system as a qubit by performing acomputation in consideration of a physical system; the first encryptionstep of encrypting the qubit acquired in the acquisition step; theadding step of adding to the encrypted qubit a quantum system havingsignature information for guaranteeing that the qubit is reallytransferred from a sender to a recipient; and the second encryption stepof encrypting the quantum to which the quantum system having thesignature information is added.
 2. The method according to claim 1,wherein in the first encryption step, a set of proper unitary operatorsto be applied to an n-qubit quantum state is prepared, and an operatorrandomly selected from the set is applied to an arbitrary n-qubitquantum state to be encrypted, thereby setting density operators of thequantum state to be transmitted in a statistically mixed state.
 3. Themethod according to claim 1, wherein in the first encryption step, a setof a total of 4^(n) operators constituted by n-fold tensor products ofthe identity operator and Pauli matrices {I, σ_(x), σ_(y), σ_(z)} to beapplied to one qubit is prepared, and an operator randomly selected fromthe set is applied to an arbitrary n-qubit quantum state to beencrypted, thereby setting density operators of the quantum state to betransmitted in a perfect, statistically mixed state.
 4. The methodaccording to claim 1, wherein in the addition step, a qubit representinga signature of the sender, which is given by a classical binary string,is added to each qubit constituting the n-qubit quantum state encryptedin the first encryption step in order to guarantee that a qubit isreally transferred from the sender to the recipient, and in the secondencryption step, a set of unitary operators to be applied to the n-qubitquantum state encrypted in the first encryption step and qubitsrepresenting the signature is prepared, and an operator randomlyselected from the set is applied to the n-qubit quantum state encryptedin the first encryption step and the qubits representing the signature.5. The method according to claim 1, wherein in the addition step, aqubit representing a signature of the sender is added to each qubitconstituting the n-qubit quantum state encrypted in the first encryptionstep in order to guarantee that a qubit is really transferred from thesender to the recipient, and in the second encryption step, entanglementis caused between the n-qubit quantum state encrypted in the firstencryption step and qubits representing the signature, and an operatorrandomly selected from {I, H, σ_(x), Hσ_(x)} (where H representsHadamard transformation, |0> → (1/{square root}{square root over(2)})(|0>+|1>), |1> → (1/{square root}{square root over (2)})(|0>−|1>)and σ_(x) represents one of Pauli matrices, |0> → |1>, |1> → |0>) isapplied to each qubit.
 6. The method according to claim 1, wherein inthe addition step, a qubit representing a signature of the sender isadded to each qubit constituting the n-qubit quantum state encrypted inthe first encryption step in order to guarantee that a quantum state isreally transferred from the sender to the recipient, and in the secondencryption step, one of the identity operator and and Hadamardtransformation H to be applied to one qubit is randomly applied to eachqubit representing the signature added in the addition step, and nqubits representing the quantum information and the qubits representingthe signature are randomly permutated.
 7. The method according to claim4, further comprising the detection step of detecting authentication andintervention of an eavesdropper by observing a qubit representing asignature by decrypting received information on a receiving side.
 8. Themethod according to claim 1, wherein the first encryption step, theaddition step, and the second encryption step are executed after Lpartial sets of arbitrary qubits are selected from n qubits representingan arbitrary quantum state to be encrypted, one auxiliary qubit is addedto each partial set so as to make a sum (parity) of values of qubitsincluded in each partial set become even, and the (n+L) qubits arerandomly permutated, in order to detect that an eavesdropper hasobserved and destroyed part of quantum information to be transmitted. 9.The method according to claim 1, wherein a sender and a recipientperform cryptographic communication procedures by using a classicalchannel, through which classical information (bit string) istransmitted, the information that is transmitted is disclosed to allowan eavesdropper to know the information, and the eavesdropper can copythe information but cannot alter or erase the information, and a quantumchannel, through which quantum information (qubit string) istransmitted, and the eavesdropper can steal, observe, and alter part ofall of a quantum state that is transmitted, but cannot clone anarbitrary quantum state, the quantum state obtained in the secondencryption is sent to the recipient through the quantum channel, uponreception of the quantum state, the recipient disconnects the quantumchannel and notifies the sender of the corresponding quantum statethrough the classical channel, upon reception of the notification fromthe recipient, the sender notifies the recipient of which type oftransformation encrypting operation in the second encryption step isthrough the classical channel, the recipient performs inversetransformation to the operation in the second encryption step notifiedfrom the sender, observes a qubit representing a signature, and notifiesthe sender of the result through the classical channel, the senderreceives the signature from the recipient, examines whether thesignature is correct, and if the signature is correct, notifies therecipient of which type of transformation the first encrypting operationis through the classical channel, or if the signature is not correct,ends the communication upon determining that an eavesdropper hasintervened, and the recipient obtains final quantum information byperforming inverse transformation to the first encrypting operation withrespect to the received quantum state.
 10. The method according to claim9, further comprises the measurement step of examining whether a qubitcarrying quantum information is present on hand, in order to allow therecipient to determine that a quantum state is really received anddisconnect the quantum channel.
 11. The method according to claim 10,wherein in the measurement step, the number of photons is measured byusing a nonlinear effect caused when two photons are introduced into acavity in which a nucleus is injected.
 12. The method according to claim1, wherein one of polarization of a photon, spins of an electron and anucleus, a spin of a nucleon in a polymer compound, and the ground stateand an excited state of an ion is used as the quantum two-state system.13. An encryption apparatus comprising: acquisition means for inputtingarbitrary quantum information and acquiring information of a quantumtwo-state system as a qubit by performing a computation in considerationof a physical system; first encryption means for encrypting the qubitacquired by said acquisition means; adding means for adding to the qubita quantum system having signature information for guaranteeing that thequbit is really transferred from a sender to a recipient; and secondencryption means for encrypting the quantum to which the quantum systemhaving the signature information is added.
 14. The apparatus accordingto claim 13, wherein said first encryption means prepares a set ofproper unitary operators to be applied to an n-qubit quantum state, andapplies an operator randomly selected from the set to an arbitraryn-qubit quantum state to be encrypted, thereby setting density operatorsof the quantum state to be transmitted in a statistically mixed state.15. The apparatus according to claim 13, wherein said first encryptionmeans prepares a set of a total of ₄n operators constituted by n-foldtensor products of the identity operator and Pauli matrices {I, σ_(x),σ_(y), σ_(z)} to be applied to one qubit, and applies an operatorrandomly selected from the set to an arbitrary n-qubit quantum state tobe encrypted, thereby setting density operators of the quantum state tobe transmitted in a perfect, statistically mixed state.
 16. Theapparatus according to claim 13, wherein said addition means adds aqubit representing a signature of the sender, which is given by aclassical binary string, to each qubit constituting the n-qubit quantumstate encrypted by said first encryption means in order to guaranteethat a qubit is really transferred from the sender to the recipient, andsaid second encryption means prepares a set of unitary operators to beapplied to the n-qubit quantum state encrypted by said first encryptionmeans and all qubits representing the signature, and applies an operatorrandomly selected from the set to the n-qubit quantum state encrypted bysaid first encryption means and the qubits representing the signature.17. The apparatus according to claim 13, wherein said addition meansadds a qubit representing a signature of the sender to each qubitconstituting the n-qubit quantum state encrypted by said firstencryption means in order to guarantee that a qubit is reallytransferred from the sender to the recipient, and said second encryptionmeans causes entanglement between the n-qubit quantum state encrypted inthe first encryption step and qubits representing the signature, andapplies an operator randomly selected from {I, H, σ_(x), Hσ_(x)} (whereH represents Hadamard transformation, (|0> → (1/{square root}{squareroot over (2)})(|0>+|1>), |1> → (1/{square root}{square root over(2)})(|0>−|1>)), and σ_(x) represents one of Pauli matrices, |0> → |1>,|1> → |0>) to each qubit.
 18. The apparatus according to claim 13,wherein said addition means adds a qubit representing a signature of thesender to each qubit constituting the n-qubit quantum state encrypted bysaid first encryption means in order to guarantee that a quantum stateis really transferred from the sender to the recipient, and said secondencryption means randomly applies one of an identity operator andHadamard transformation H to be applied to one qubit to each qubitrepresenting the signature added by said addition means, and randomlypermutates the n qubits representing the quantum information and thequbits representing the signature.
 19. The apparatus according to claim16, further comprising detection means for detecting authentication andintervention of an eavesdropper by observing a qubit representing asignature by decrypting received information on a receiving side. 20.The apparatus according to claim 13, wherein said first encryptionmeans, said addition means, and said second encryption means areexecuted after L partial sets of arbitrary qubits are selected from nqubits representing an arbitrary quantum state to be encrypted, oneauxiliary qubit is added to each partial set so as to make a sum(parity) of values of qubits included in each partial set become even,and the (n+L) qubits are randomly permutated, in order to detect that aneavesdropper has observed and destroyed part of quantum information tobe transmitted.
 21. The apparatus according to claim 13, wherein asender and a recipient perform cryptographic communication procedures byusing a classical channel, through which classical information (bitstring) is transmitted, the information that is transmitted is disclosedto allow an eavesdropper to know the information, and the eavesdroppercan copy the information but cannot alter or erase the information, anda quantum channel, through which quantum information (qubit string) istransmitted, and the eavesdropper can steal, observe, and alter part ofall of a quantum state that is transmitted, but cannot clone anarbitrary quantum state, the quantum state obtained by said secondencryption is sent to the recipient through the quantum channel, uponreception of the quantum state, the recipient disconnects the quantumchannel and notifies the sender of the corresponding quantum statethrough the classical channel, upon reception of the notification fromthe recipient, the sender notifies the recipient of which type oftransformation encrypting operation by said second encryption means isthrough the classical channel, the recipient performs inversetransformation to the operation in said second encryption means notifiedfrom the sender, observes a qubit representing a signature, and notifiesthe sender of the result through the classical channel, the senderreceives the signature from the recipient, examines whether thesignature is correct, and if the signature is correct, notifies therecipient of which type of transformation first encrypting operation isthrough the classical channel, or if the signature is not correct, endsthe communication upon determining that an eavesdropper has intervened,and the recipient obtains final quantum information by performinginverse transformation to the first encrypting operation with respect tothe received quantum state.
 22. The apparatus according to claim 21,further comprises measurement means for examining whether a qubitcarrying quantum information is present on hand, in order to allow therecipient to determine that a quantum state is really received anddisconnect the quantum channel.
 23. The apparatus according to claim 22,wherein said measurement means measures the number of photons by using anonlinear effect caused when two photons are introduced into a cavity inwhich a nucleus is injected.
 24. The apparatus according to claim 13,wherein one of polarization of a photon, spins of an electron and anucleus, a spin of a nucleon in a polymer compound, and the ground stateand an excited state of an ion is used as the quantum two-state system.